Actively exploited · Published Oct 12, 2020 · Assigned by sonicwall
CVE-2020-5135
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity buffer overflow in SonicOS from SonicWall. Attackers are actively exploiting it in the wild (listed by CISA on March 15, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 26.9% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 5, 2022.
Official description
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0010 x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5135 government-resource