Lucene search

K
zdiErik WynterZDI-24-421
HistoryMay 07, 2024 - 12:00 a.m.

SonicWALL GMS Virtual Appliance ECMClientAuthenticator Hard-Coded Credential Authentication Bypass Vulnerability

2024-05-0700:00:00
Erik Wynter
www.zerodayinitiative.com
3
sonicwall
gms
virtual appliance
ecmclientauthenticator
credential bypass
authentication bypass
vulnerability

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

28.8%

This vulnerability allows remote attackers to bypass authentication on affected installations of SonicWALL GMS Virtual Appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ECMClientAuthenticator class. The issue results from the use of a hard-coded credential. An attacker can leverage this vulnerability to bypass authentication on the system.

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

28.8%

Related for ZDI-24-421