CVE DATABASE / CVE-2024-40766

CVE-2024-40766

SonicWall SonicOS Improper Access Control Vulnerability

CVSS 9.8 · CRITICAL ⚠ CISA KEV — ACTIVELY EXPLOITED RANSOMWARE

On the CISA KEV catalog

Confirmed exploited in the wild. Added 2024-09-09. Federal remediation due 2024-09-30.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Summary

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

CVSS 3.1 breakdown

Base score	9.8 (CRITICAL)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector	NETWORK
Attack complexity	LOW
Privileges required	NONE
User interaction	NONE
Scope	UNCHANGED
Confidentiality	HIGH
Integrity	HIGH
Availability	HIGH

Weakness type (CWE)

CWE-284

Affected products

Sonicwall sonicosSonicwall sohoSonicwall nssp 12400Sonicwall nssp 12800Sonicwall sm9800Sonicwall nsa 2650Sonicwall nsa 3600Sonicwall nsa 3650Sonicwall nsa 4600Sonicwall nsa 4650Sonicwall nsa 5600Sonicwall nsa 5650Sonicwall nsa 6600Sonicwall nsa 6650Sonicwall sm 9200Sonicwall sm 9250Sonicwall sm 9400Sonicwall sm 9450Sonicwall sm 9600Sonicwall sm 9650

Check this CVE live

Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.

References

Data: NIST NVD + CISA KEV. NVD last modified 2025-10-31. Always verify against the vendor advisory before acting.