SonicWall Firewalls Targeted by Exploited Vulnerability: Over 4,500 Devices at Risk

Cybersecurity experts have confirmed that a critical security vulnerability (CVE-2024-53704) in SonicWall firewalls is being actively exploited by threat actors. This vulnerability affects the SSLVPN authentication mechanism, allowing attackers to bypass authentication requirements and gain unauthorized access to targeted networks.

The attacks accelerated after the release of a Proof-of-Concept (PoC) exploit code.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has classified this vulnerability as critical. It impacts SonicOS versions 7.1.x (up to version 7.1.1-7058), 7.1.2-7019, and 8.0.0-8035, which are commonly used in Gen 6 and Gen 7 firewalls, as well as SOHO series devices.

SonicWall issued security updates on January 7 to address the flaw and urged customers to update their systems immediately. For those unable to update, the company recommended restricting device access to trusted sources only and cutting off internet access entirely.

However, the publication of PoC exploit code by Bishop Fox security researchers on February 10 has shown attackers how to exploit the vulnerability. Following this release, Arctic Wolf, a cybersecurity firm, reported a sharp increase in attack attempts.

Over 4,500 Devices Vulnerable
Internet scans conducted by Bishop Fox researchers on February 7 revealed that more than 4,500 SonicWall SSL VPN servers remain unprotected against the vulnerability. The company warned that these devices are easy targets for attackers and urged administrators to apply security patches as soon as possible.

Previously, ransomware groups Akira and Fog were known to have targeted SonicWall firewalls. According to a report published by Arctic Wolf in October, at least 30 cyberattacks were traced back to compromised SonicWall VPN accounts.

Experts emphasize that SonicWall users must immediately update their devices to close the security hole. If updates are not possible, disabling the SSLVPN service is recommended.