Read the docs

SonicWall

Records284All Threatist records
Exploited (KEV)24In CISA KEV
CVSS critical65CVSS 9.0–10.0
CVSS high124CVSS 7.0–8.9

Exploited now

SonicWall records in CISA KEV

Components

Products in the NVD configurations · select one to filter the records

Records

19 records in Sonicosv · all components

TI-2020-04229 CVE-2020-5135 · GHSA-vw5m-894x-7rp4

Buffer overflow in SonicWall SonicOS

Priority CRITICAL 100KEV

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.26869 Published 2020-10-12 No fix listed CWE-120
Priority HIGH 81

A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.75521 Published 2022-03-25 No fix listed CWE-121
Priority MEDIUM 59

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an atta…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.60156 Published 2018-05-22 Partial fix CWE-203
Priority MEDIUM 45

A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access advanced routing services.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01392 Published 2019-04-02 No fix listed CWE-284
TI-2021-03340 CVE-2021-20019 · GHSA-32x4-2mw2-5hjv

Information disclosure in SonicWall SonicOS

Priority LOW 36

A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01414 Published 2021-06-23 No fix listed CWE-200
TI-2020-04234 CVE-2020-5140 · GHSA-xv6m-x759-j99f

Out-of-bounds read in SonicWall SonicOS

Priority LOW 36

A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service by sending a malicious HTTP request that leads to memory addresses leak.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01763 Published 2020-10-12 No fix listed CWE-125
Priority LOW 36

A Heap Overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads to SonicOS crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01769 Published 2020-10-12 No fix listed CWE-122
TI-2020-04231 CVE-2020-5137 · GHSA-72ph-pjgj-f73w

Buffer overflow in SonicWall SonicOS

Priority LOW 36

A buffer overflow vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads to firewall crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01754 Published 2020-10-12 No fix listed CWE-120
TI-2020-04227 CVE-2020-5133 · GHSA-9vvw-q328-vfmx

Buffer overflow in SonicWall SonicOS

Priority LOW 36

A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service due to buffer overflow, which leads to a firewall crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01754 Published 2020-10-12 No fix listed CWE-120
Priority LOW 35

A vulnerability in SonicWall SonicOS and SonicOSv TLS CBC Cipher allow remote attackers to obtain sensitive plaintext data when CBC cipher suites are enabled.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01192 Published 2019-04-02 No fix listed CWE-327
Priority LOW 33

A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00924 Published 2019-12-31 No fix listed CWE-285
Priority LOW 31

A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01242 Published 2020-10-12 No fix listed CWE-799
TI-2020-04230 CVE-2020-5136 · GHSA-85r9-8q36-5hm5

Buffer overflow in SonicWall SonicOS

Priority LOW 31

A buffer overflow vulnerability in SonicOS allows an authenticated attacker to cause Denial of Service (DoS) in the SSL-VPN and virtual assist portal, which leads to a firewall crash.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01118 Published 2020-10-12 No fix listed CWE-120
TI-2020-04228 CVE-2020-5134 · GHSA-m48j-cx36-2j54

Out-of-bounds read in SonicWall SonicOS

Priority LOW 31

A vulnerability in SonicOS allows an authenticated attacker to cause out-of-bound invalid file reference leads to a firewall crash.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01124 Published 2020-10-12 No fix listed CWE-125
TI-2020-04236 CVE-2020-5142 · GHSA-mm23-cj9m-mh27

Cross-site scripting in SonicWall SonicOS

Priority LOW 30

A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01253 Published 2020-10-12 No fix listed CWE-79
Priority LOW 30

A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloading certificate with specific extension.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00671 Published 2019-04-02 No fix listed CWE-248
Priority LOW 27

SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server responses.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01592 Published 2020-10-12 No fix listed CWE-203
Priority LOW 24

In SonicWall SonicOS, administrators without full permissions can download imported certificates.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00207 Published 2019-02-19 No fix listed CWE-285
Open these records in search →