Critical Vulnerability Found in SonicWall VPN Portal – Patch Now

Summary

SonicWall released a security advisory regarding a critical stack-based buffer overflow vulnerability in the VPN Portal of SonicWall’s Network Security Appliance. Vulnerability CVE-2020-5135 may allow a remote attacker to cause a denial-of-service (DoS) condition and potentially execute arbitrary code by sending a malicious request to the firewall. Affected versions include SonicOS 6.5.4.7-79n and below, 6.5.1.11 and below, 6.0.5.3-93o and below, 7.0.0.0-1, and SonicOSv 6.5.4.4-44v-21-794 and below. After conducting a Shodan search, researchers from Tripwire’s Vulnerability and Exposure Research Team (VERT) identified nearly 800,000 internet-facing SonicWall hosts, although it is unclear if they are all vulnerable to this flaw. The Cybersecurity and Infrastructure Security Agency (CISA) has previously issued alerts regarding Advanced Persistent Threat (APT) groups using SSL VPN vulnerabilities as a threat vector to perform cyberattacks.

Recommendations

The NJCCIC urges organizations using affected products to upgrade to a patched version as detailed in the advisory as soon as possible. If upgrading is not feasible at this time, VERT recommends disabling SSL VPN portals as a temporary mitigation. Additional details can be found in the Tenable blog post.