Dive Brief:
- Security researchers warn a critical vulnerability in SonicWall’s SonicOS is under active exploitation. The flaw, listed as CVE-2024-53704, is an improper authentication vulnerability in the SSL VPN mechanism, which can allow a remote actor to bypass authentication.
- SonicWall issued an advisory and patched the vulnerability on Jan. 7. However, researchers from Bishop Fox released a proof-of-concept earlier this month, and Arctic Wolf researchers last week warned they had evidence of threat actors targeting the vulnerability.
- The Cybersecurity and Infrastructure Security Agency on Tuesday added CVE-2024-53704 to its known exploited vulnerabilities catalog.
Dive Insight:
SonicWall patched the vulnerability after researchers from Computest Security disclosed the flaw. At the time, SonicWall said it was not aware of active exploitation.
However, Bishop Fox researchers released technical details showing how attackers can hijack active SSL VPN sessions and gain unauthorized access to a network.
According to Bishop Fox, an attacker can read a user’s Virtual Office bookmarks, get a client configuration profile for NetExtender, access private networks and conduct other activities.
“As the scope of the vulnerability is currently understood, it could be used by threat actors to bypass authentication (including MFA) to disrupt service availability, and for disclosure of confidential information,” Stefan Hostetler, lead threat intelligence researcher at Arctic Wolf, said via email.
SonicWall said “there are no reports of exploitation related to this vulnerability,” in an emailed statement.
The company however reiterated a statement issued last week, urging customers and partners to upgrade their firmware.
Caitlin Condon, director of vulnerability intelligence at Rapid7, said the firm was aware of reports of active exploitation, but had not seen any successful exploitation in its production environments.
Arctic Wolf researchers said they have previously seen Akira ransomware actors target SSL VPN accounts on SonicWall devices as initial access points for attacks.
SonicWall in January warned that threat actors were targeting a critical vulnerability, listed as CVE-2025-23006, in SMA 1000 appliances.
