CVE-2020-5141 — Improper Control of Interaction Frequency in Sonicos

CWE-799 — Improper Control of Interaction Frequency CWE-307 — Improper Restriction of Excessive Authentication Attempts3 documents3 sources

Severity

6.5MEDIUMNVD

EPSS

0.5%

top 35.94%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Sonicwall Sonicos Sonicwall Sonicosv

Timeline

PublishedOct 12

Latest updateMay 24

Description

A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages3 packages

▶NVDsonicwall/sonicosv6.5.4.4

▶NVDsonicwall/sonicos6.0.0.0 — 6.0.5.3+4

▶CVEListV5sonicwall/sonicos7 versions+6

🔴Vulnerability Details

GHSA

GHSA-vhrg-9cjq-6j3h: A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service↗2022-05-24

▶

CVEList

CVE-2020-5141: A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service↗2020-10-12

▶