Sonicwall Sonicos vulnerabilities

CVE-2021-3449 [MEDIUM] CWE-476 CVE-2021-3449: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a cr

CVE-2019-7475 [CRITICAL] CWE-284 CVE-2019-7475: A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configu A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access advanced routing services. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8

CVE-2021-20048 [HIGH] CWE-121 CVE-2021-20048: A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenti A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions.

CVE-2021-20046 [HIGH] CWE-121 CVE-2021-20046: A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote aut A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the firewall. This vulnerability affected SonicOS Gen 5, Gen 6 and Gen 7 firmware versions.

CVE-2023-41715 [HIGH] CWE-269 CVE-2023-41715: SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunne SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel.

CVE-2024-40765 [CRITICAL] CWE-190 CVE-2024-40765: An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a specially crafted IKEv2 payload.

CVE-2019-12265 [MEDIUM] CWE-401 CVE-2019-12265: Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client compon Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.

CVE-2024-12803 [HIGH] CWE-121 CVE-2024-12803: A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remot A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.

CVE-2023-1101 [HIGH] CWE-307 CVE-2023-1101: SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.

CVE-2024-53705 [HIGH] CWE-918 CVE-2024-53705: A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection to an IP address on any port when the user is logged in to the firewall.

CVE-2019-12259 [HIGH] CWE-476 CVE-2019-12259: Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client componen Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.

CVE-2024-12805 [HIGH] CWE-134 CVE-2024-12805: A post-authentication format string vulnerability in SonicOS management allows a remote attacker to A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.

CVE-2026-0204 [HIGH] CWE-306 CVE-2026-0204: A vulnerability in the access control mechanism of SonicOS may allow certain management interface fu A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.

CVE-2020-5138 [HIGH] CWE-122 CVE-2020-5138: A Heap Overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denia A Heap Overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads to SonicOS crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.

CVE-2020-5137 [HIGH] CWE-120 CVE-2020-5137: A buffer overflow vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial A buffer overflow vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads to firewall crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.

CVE-2020-5140 [HIGH] CWE-125 CVE-2020-5140: A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service by sending a malicious HTTP request that leads to memory addresses leak. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version Soni

CVE-2020-5139 [HIGH] CWE-763 CVE-2020-5139: A vulnerability in SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial o A vulnerability in SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS) due to the release of Invalid pointer and leads to a firewall crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.

CVE-2020-5133 [HIGH] CWE-120 CVE-2020-5133: A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service due t A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service due to buffer overflow, which leads to a firewall crash. This vulnerability affected SonicOS Gen 6 version 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.

CVE-2024-53706 [HIGH] CWE-269 CVE-2024-53706: A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-priv A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potentially lead to code execution.

CVE-2019-7477 [HIGH] CWE-327 CVE-2019-7477: A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain se A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher suites are enabled. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWA