SonicOS SSL VPN Authentication Bypass Vulnerability (CVE-2024-53704)
A proof-of-concept exploit has been published for CVE-2024-53704, which affects SonicWall NGFWs
Summary
A proof-of-concept exploit has been published for CVE-2024-53704, which affects SonicWall NGFWs
Affected platforms
The following platforms are known to be affected:
Threat details
Exploitation of CVE-2024-53704
A security firm has reported active exploitation of CVE-2024-53704.
SonicWall's SNWLID-2025-0003 advisory also discloses that proof-of-concept exploits for the vulnerability are publicly available, stating:
'Proof-of-Concepts (PoCs) for the SonicOS SSL VPN Authentication Bypass Vulnerability (CVE-2024-53704) are now publicly available. This significantly increases the risk of exploitation.'
Due to public proof-of-concept exploits and observed exploitation, NHS England's National CSOC urge organisations to patch immediately.
Introduction
A proof-of-concept (PoC) exploit has been published by security researchers for an authentication bypass vulnerability in the SonicOS SSL VPN component. SonicWall appliances provide virtual private network (VPN) and 'next-gen' firewall capabilities.
SonicWall formally disclosed and released security updates addressing CVE-2024-53704 on 07 January 2025. Successful exploitation of CVE-2024-53704 could allow a remote, unauthenticated attacker to bypass authentication and hijack a legitimate SSL VPN session.
Researchers at Bishop Fox have stated 'an attacker with control of an active SSL VPN session can read the user’s Virtual Office bookmarks, obtain a client configuration profile for NetExtender, open a VPN tunnel, access private networks available to the hijacked account, and log out the session (terminating the user’s connection as well).'
Threat updates
| Date | Update |
|---|---|
| 14 Feb 2025 | Cyber Alert updates to reflect active exploitation of CVE-2024-53704 in-the-wild |
Remediation advice
Affected organisations must review SonicWall security advisory SNWLID-2025-0003 and apply the relevant updates.
Remediation steps
| Type | Step |
|---|---|
| Patch |
SNWLID-2025-0003 Apply security updates as soon as practicable. psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003 |
| Guidance |
To minimize the potential impact of SSL VPN vulnerabilities, please ensure that access is limited to trusted sources, or disable SSL VPN access from the Internet. For more information about disabling firewall SSL VPN access, see this link. https://www.sonicwall.com/support/knowledge-base/how-can-i-setup-ssl-vpn/170505609285133 |
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 14 February 2025 2:12 pm