CRITICAL · CVSS 9.8
ACTIVELY EXPLOITED
CVE-2024-53704: SonicWall SonicOS SSLVPN Improper Authentication Vulnerability
| Vendor | SonicWall |
|---|---|
| Product | SonicOS |
| CVSS score | 9.8 · CVSS 3.1 · CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Actively exploited | Yes |
| Added to CISA KEV | 18 Feb 2025 |
| CISA federal deadline | 11 Mar 2025 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-287 |
| NVD published | 9 Jan 2025 |
| NVD last modified | 9 Nov 2026 |
| NVD status | Analyzed |
Affected versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Sonicwall Sonicos | from 7.1.1-7040 up to 7.1.1-7058 | – |
| Sonicwall Sonicos | 7.1.2-7019 | – |
| Sonicwall Sonicos | 8.0.0-8035 | – |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
SOURCES
Other SonicWall flaws
- CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- CVE-2026-15410: SonicWall SMA1000 Appliances Code Injection Vulnerability
- CVE-2026-15409: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 9 Nov 2026.