Nearly 800,000 SonicWall VPNs Need Critical Flaw Patching
Nearly 800,000 VPNs around the world need urgent patching after a vendor issued a security update for a critical flaw this week.
Researchers from Tripwire found the stack-based buffer overflow vulnerability in SonicWall’s Network Security Appliance (NSA), or more specifically, its underlying SonicOS software.
According to Tripwire security researcher Craig Young, who discovered the bug, the problem exists in the HTTP/HTTPS service used for product management and SSL VPN remote access. It can apparently be triggered by an unauthenticated HTTP request involving a custom protocol handler.
“An unskilled attacker can use this flaw to cause a persistent denial of service condition,” Young continued.
“Tripwire VERT has also confirmed the ability to divert execution flow through stack corruption indicating that a code execution exploit is likely feasible. This flaw exists pre-authentication and within a component (SSLVPN) which is typically exposed to the public internet.”
With over 795,000 SonicWall devices exposed according to a Shodan search made by Tripwire on Wednesday, the bug could be exploited to cause widespread damage.
According to SonicWall, the vulnerability has a CVSS score of 9.4, perhaps a reflection of the fact it could lead not only to denial of service but also arbitrary remote code execution.
The affected versions are: SonicOS 22.214.171.124-79n and earlier, SonicOS 126.96.36.199-4n and earlier, SonicOS 188.8.131.52-93o and earlier, SonicOSv 184.108.40.206-44v-21-794 and earlier and SonicOS 220.127.116.11-1.
The vendor released patches on Monday.
VPN systems are increasingly being targeted by attackers looking to find a way into corporate systems, given the large numbers of remote workers currently reliant on them.
In April it was confirmed that cyber-criminals were exploiting known bugs in Citrix and Pulse Secure VPNs to deploy ransomware in hospitals, while just this week it emerged that other attackers were chaining VPN exploits with Zerologon to compromise Active Directory (AD) identity services.