SonicWall SonicOS

• CVE-2026-19868 High 7.5 Exploited An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful –
• CVE-2024-53704 High 8.2 Exploited An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. 95.3%
• CVE-2024-40766 Critical 9.3 Exploited An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the fir 18.4%
• CVE-2020-5135 Critical 9.8 Exploited A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnera 26.9%
• CVE-2026-0516 Medium 6.5 A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary 0.3%
• CVE-2026-0206 Medium 4.9 A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall. 0.5%
• CVE-2026-0205 Medium 6.8 A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. 0.4%
• CVE-2026-0204 High 8.0 A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions. 0.4%
• CVE-2026-3439 Medium 4.9 A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewall. 0.3%
• CVE-2026-0402 Medium 4.9 A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall. 0.4%
• CVE-2026-0401 Medium 4.9 A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall. 0.4%
• CVE-2026-0400 Medium 4.9 A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall. 0.5%
• CVE-2026-0399 Medium 4.9 Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint. 0.4%
• CVE-2025-40601 High 7.5 A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash. 0.9%
• CVE-2025-40600 Critical 9.8 Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption. 1.0%
• CVE-2025-32818 High 7.5 A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash the firewall, potentially leading to a Denial-of-Service (DoS 0.8%
• CVE-2024-12802 Critical 9.1 SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Micr 0.5%
• CVE-2024-12806 Medium 4.9 A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file. 0.7%
• CVE-2024-12805 High 7.2 A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. 0.7%
• CVE-2024-12803 High 7.2 A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. 0.8%
• CVE-2024-40765 Critical 9.8 An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and potentially execute arbitrary code by sendi 0.8%
• CVE-2024-53706 High 7.8 A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potentially lead to code execution. 0.3%
• CVE-2024-53705 High 7.5 A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection to an IP address on any port when the user is logged in to th 0.7%
• CVE-2024-40762 Critical 9.8 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predicted by an attacker potentially resulting i 1.0%
• CVE-2024-40764 High 7.5 Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS). 0.7%
• CVE-2024-29013 Medium 5.3 Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function. 0.6%
• CVE-2024-29012 Medium 4.9 Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS) via sscanf function. 0.5%
• CVE-2024-22397 High 8.3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticated attacker as a firewall 'admin' user to store and execute 1.1%
• CVE-2024-22396 Medium 5.3 An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of Service (DoS) and potentially execute arbitrary code by sendi 1.1%
• CVE-2024-22394 Critical 9.8 An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker to bypass authentication.  This issue aff 0.7%
• CVE-2023-41715 High 8.8 SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel. 0.8%
• CVE-2023-41713 Unrated SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function. 0.7%
• CVE-2023-41712 Unrated SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash. 1.0%
• CVE-2023-41711 Unrated SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash. 1.0%
• CVE-2023-39280 Unrated SonicOS p ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints leads to a firewall crash. 1.0%
• CVE-2023-39279 Unrated SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash. 1.0%
• CVE-2023-39278 Unrated SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash. 1.0%
• CVE-2023-39277 Unrated SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL endpoints leads to a firewall crash. 1.0%
• CVE-2023-39276 Unrated SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash. 1.0%
• CVE-2023-0656 Unrated A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash. 41.3%
• CVE-2023-1101 High 8.8 SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes. 0.7%
• CVE-2022-22278 Unrated A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacke 1.0%
• CVE-2022-22277 Unrated A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext. 0.8%
• CVE-2022-22276 Unrated A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user. 0.8%
• CVE-2022-22275 Unrated Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service (DoS) attack if a t 1.1%
• CVE-2022-22274 Unrated A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the fi 75.5%
• CVE-2021-20048 Unrated A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in the fir 2.0%
• CVE-2021-20046 Unrated A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker to cause Denial of Service (DoS) and potentially results in code execution in th 2.0%
• CVE-2021-20031 Unrated A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains. 13.0%
• CVE-2021-20019 Unrated A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability. 1.4%