Vulnerability · Published Jan 9, 2025 · Assigned by sonicwall

CVE-2024-12802

Critical 9.1

In plain English

A critical-severity security flaw in SonicOS from SonicWall. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 57.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.

Affected products (as reported)

Vendor	Product	Versions
SonicWall	SonicOS	6.5.4.4-44v-21-2457 and older versions6.5.4.15-117n and older versions7.0.1-5161 and older versions7.1.1-7058 and older versions7.1.2-70198.0.0-8035

Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0001 vendor-advisory