Skip to main content

A proof-of-concept exploit has been published for CVE-2024-53704, which affects SonicWall NGFWs

Threat ID:CC-4619
Threat Severity:High
Published:12 February 2025 3:30 PM

Summary

A proof-of-concept exploit has been published for CVE-2024-53704, which affects SonicWall NGFWs

The following platforms are known to be affected:

Threat details

Exploitation of CVE-2024-53704

A security firm has reported active exploitation of CVE-2024-53704.

SonicWall's SNWLID-2025-0003 advisory also discloses that proof-of-concept exploits for the vulnerability are publicly available, stating:

'Proof-of-Concepts (PoCs) for the SonicOS SSL VPN Authentication Bypass Vulnerability (CVE-2024-53704) are now publicly available. This significantly increases the risk of exploitation.'

Due to public proof-of-concept exploits and observed exploitation, NHS England's National CSOC urge organisations to patch immediately.


Introduction

A proof-of-concept (PoC) exploit has been published by security researchers for an authentication bypass vulnerability in the SonicOS SSL VPN component. SonicWall appliances provide virtual private network (VPN) and 'next-gen' firewall capabilities.

SonicWall formally disclosed and released security updates addressing CVE-2024-53704 on 07 January 2025. Successful exploitation of CVE-2024-53704 could allow a remote, unauthenticated attacker to bypass authentication and hijack a legitimate SSL VPN session.

Researchers at Bishop Fox have stated 'an attacker with control of an active SSL VPN session can read the user’s Virtual Office bookmarks, obtain a client configuration profile for NetExtender, open a VPN tunnel, access private networks available to the hijacked account, and log out the session (terminating the user’s connection as well).'

Threat updates

   
14 Feb 2025 Cyber Alert updates to reflect active exploitation of CVE-2024-53704 in-the-wild

Remediation advice

Affected organisations must review SonicWall security advisory SNWLID-2025-0003 and apply the relevant updates.

Remediation steps

   
Patch

SNWLID-2025-0003 

Apply security updates as soon as practicable.


psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003
Guidance

To minimize the potential impact of SSL VPN vulnerabilities, please ensure that access is limited to trusted sources, or disable SSL VPN access from the Internet. For more information about disabling firewall SSL VPN access, see this link.


https://www.sonicwall.com/support/knowledge-base/how-can-i-setup-ssl-vpn/170505609285133

Definitive source of threat updates

CVE Vulnerabilities

StatusPublished
CVE-2024-53704An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

Last edited: 14 February 2025 2:12 pm

Back to top