CVE-2024-40766 Known ransomware use

SonicWall SonicOS Improper Access Control Vulnerability

SonicWall — SonicOS

Added to KEV catalog: 9 September 2024
Federal remediation due date: 30 September 2024
Weakness classification (CWE): CWE-284

CISA Description

SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015; https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40766

View on NVD View on MITRE CVE View full CISA catalog

More SonicWall Vulnerabilities

CVE-2025-40602

SonicWall SMA1000 Missing Authorization Vulnerability

CVE-2023-44221

SonicWall SMA100 Appliances OS Command Injection Vulnerability

CVE-2021-20035

SonicWall SMA100 Appliances OS Command Injection Vulnerability

CVE-2024-53704

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

CVE-2025-23006

SonicWall SMA1000 Appliances Deserialization Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services