SonicWall Releases Security Updates for SMA100 SSL-VPN Products
Three buffer overflow vulnerabilities could lead to code execution and three others concern path traversal, authentication bypass, and insecure randomness
Summary
Three buffer overflow vulnerabilities could lead to code execution and three others concern path traversal, authentication bypass, and insecure randomness
Affected platforms
The following platforms are known to be affected:
Threat details
CVE-2024-38475 under active exploitation
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-38475 to the Known Exploited Vulnerabilities (KEV) catalogue. CVE-2024-38475 can be chained with CVE-2023-44221 to allow a remote unauthenticated attacker to execute arbitrary commands on SMA100 devices.
Security researchers have also published a proof-of-concept exploit. The NHS England National CSOC assesses further exploitation as highly likely.
Introduction
SonicWall has released a security advisory to address six vulnerabilities in SMA100 SSL-VPN appliances. SonicWall Secure Mobile Access (SMA) is a unified secure access gateway that provides a Secure Sockets Layer (SSL) virtual private network (VPN), context aware device authorisation, application level VPN, and advanced authentication with federated single sign-on (SSO) for cloud and on-premises resources.
Vulnerability details
CVE-2024-38475 - attributed to publicly known Apache HTTP Server vulnerability
- CWE-35: Path traversal vulnerability with a CVSSv3 Score of 7.5
- An attacker exploiting this vulnerability may be able to map URLs to file system locations that are permitted to be served by the server.
CVE-2024-40763 - affecting SonicWALL SMA100 SSLVPN
- CWE-122: Heap-based buffer overflow vulnerability with a CVSSv3 score of 7.5
- A remote, authenticated attacker could exploit this heap-based buffer overflow vulnerability, potentially leading to remote code execution (RCE).
CVE-2024-45318 - affecting SonicWall SMA100 SSLVPN web management interface
- CWE-121: Stack-based buffer overflow vulnerability with a CVSSv3 score of 8.1
- An attacker could exploit this stack-based buffer overflow vulnerability, potentially leading to RCE.
CVE-2024-45319 - affecting SonicWall SMA100 SSLVPN
- CWE-798: Certificate-based authentication bypass vulnerability with a CVSSv3 score of 6.3
- A remote, authenticated attacker can circumvent the certificate requirement during authentication.
CVE-2024-53702 - affecting SonicWall SMA100 SSLVPN backup code generator
- CWE-338: Insecure randomness vulnerability with a CVSSv3 score of 5.3
- An attacker could exploit this vulnerability by abusing the cryptographically weak pseudo-random number generator (PRNG) in the SonicWall SMA100 SSLVPN backup code generator, which could result in exposing the generated secret.
CVE-2024-53703 - affecting SonicWall SMA100 SSLVPN mod_httprp library loaded by the Apache web server
- CWE-121: Stack-based buffer overflow vulnerability with a CVSSv3 score of 8.1
- An attacker could exploit this stack-based buffer overflow vulnerability, potentially leading to RCE.
Threat updates
| Date | Update |
|---|---|
| 2 May 2025 | CVE-2024-38475 added to CISA KEV |
Remediation advice
Affected organisations are encouraged to review SonicWall advisory SNWLID-2024-0018 and apply the relevant updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 2 May 2025 11:37 am