⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Due date: 2024-09-30.

CVE-2024-40766Improper Access Control in Sonicos

Severity
9.8CRITICALNVD
EPSS
3.4%
top 12.50%
CISA KEV
KEVRansomware
Added 2024-09-09
Due 2024-09-30
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedAug 23
KEV addedSep 9
KEV dueSep 30
Latest updateSep 11
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

NVDsonicwall/sonicos< 5.9.2.14-13o+3
CVEListV5sonicwall/sonicos5.9.2.14-12o and older versions, 6.5.4.14-109n and older versions, 7.0.1-5035 and older versions+2

🔴Vulnerability Details

3
GHSA
GHSA-8736-pr6r-r9hr: An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource2024-08-23
CVEList
CVE-2024-40766: An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource2024-08-23
VulnCheck
SonicWall SonicOS Improper Access Control Vulnerability2024

📋Vendor Advisories

1
CISA
SonicWall SonicOS Improper Access Control Vulnerability2024-09-09

🕵️Threat Intelligence

6
Bleepingcomputer
Akira ransomware exploiting critical SonicWall SSLVPN bug again2025-09-11
Bleepingcomputer
SonicWall finds no SSLVPN zero-day, links ransomware attacks to 2024 flaw2025-08-07
Bleepingcomputer
Fog ransomware targets SonicWall VPNs to breach corporate networks2024-10-27
Bleepingcomputer
Critical SonicWall SSLVPN bug exploited in ransomware attacks2024-09-09
Bleepingcomputer
SonicWall SSLVPN access control flaw is now exploited in attacks2024-09-06
CVE-2024-40766 — Improper Access Control in Sonicos | cvebase