References https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015 https://www.sonicwall.com/support/notices/product-notice-improper-access-control-vulnerability-in-sonicos/kA1VN0000000Tq10AE https://www.nics.nat.gov.tw/core_business/information_security_information_sharing/Vulnerability_Alert_Announcements/7010a182-a34b-411f-b496-671447fa86e4/ https://www.anquanke.com/post/id/299950 https://www.secrss.com/articles/74463 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003 https://www.cisecurity.org/advisory/a-vulnerability-in-sonicwall-sonicos-management-access-and-sslvpn-could-allow-for-unauthorized-access_2024-097 https://www.sonicwall.com/support/notices/product-notice-sslvpn-and-ssh-vulnerability-in-sonicos/kA1VN0000000RBZ0A2 https://blog.csdn.net/jd_cx/article/details/148208331 https://www.ithome.com.tw/news/172407
Related VulnerabilitiesPoCCVE-2019-7481: SonicWall SRA 4600 VPN - SQL InjectionPoCCVE-2021-20031: SonicWall SonicOS 7.0 - Open RedirectPoCCVE-2021-20038: SonicWall SMA100 Stack - Buffer Overflow/Remote Code ExecutionPoCCVE-2023-0126: SonicWall SMA1000 LFIPoCCVE-2023-34124: SonicWall GMS and Analytics Web Services - Shell InjectionPoCCVE-2024-38475: Sonicwall - Pre-Authentication Arbitrary File ReadPoCsonicwall-ssl-vpn-rce: SonicWall SSL-VPN 远程命令执行漏洞PoCCVE-2021-20021: SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account CreationPoCCVE-2023-34133: SonicWall GMS and Analytics - SQL InjectionPoCsonicwall-nsm-log4j-rce: Sonicwall NSM - Remote Code Execution (Apache Log4j)PoCsonicwall-sslvpn-shellshock: Sonicwall SSLVPN - Remote Code Execution (ShellShock)PoCsonicwall-sslvpn-panel: SonicWall Virtual Office SSLVPN Panel