What happened
A vulnerability has been identified in SonicWall SonicOS SSLVPN, which may allow an attacker to bypass SAML authentication controls. This vulnerability is caused by the improper use of single-factor authentication, potentially enabling an attacker with valid credentials for an alternative authentication method to bypass SAML-based multi-factor authentication (MFA). The security flaw is actively exploited in the wild, with attackers leveraging an exposed service that can be attacked directly with no user involvement required. Successful exploitation could compromise access controls, potentially allowing unauthorised access to affected systems without prior access or any action from users. The vulnerability stems from a flaw in the affected SonicWall SonicOS SSLVPN component, identified as CWE-308. It impacts SonicOS versions 7.3.3-7015 and older, as well as 8.2.2-8015 and older versions. Exploitation is confirmed to be feasible remotely over a network, which emphasises the importance of network-level mitigations such as segmentation and access controls in front of the service. The CVSS base score assigned to this flaw is 7.5, indicating a high severity level. The vulnerability has been reported by CISA KEV, with exploitation activity observed in the wild.
Who is affected
Organisations running SonicWall SonicOS SSLVPN versions 7.3.3-7015 and earlier, as well as 8.2.2-8015 and earlier, are affected by this vulnerability. Any deployment of these versions exposed to the network without adequate access controls or network segmentation is at risk. The high-impact nature of the vulnerability means that affected deployments are vulnerable to unauthorised access, which could result in security breaches or compromise of sensitive information.
Recommended actions
- Apply the vendor's mitigations or updates after checking the official SonicWall advisory for fixed versions.
- Restrict network access to SonicOS SSLVPN services by implementing network segmentation and access controls to limit exposure.
- Monitor network traffic for unusual or unauthorized access attempts targeting the SSLVPN service.
