Improper access control in SonicWall SonicOS
Priority MEDIUM 45CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access advanced routing services. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
Why it matters now
EPSS 0.01392 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SonicWall | SonicOS | up to 5.9.1.10; 6.2.7.3; 6.5.1.3; 6.5.2.2; 6.5.3.1; 6.2.7.8; 6.4.0.0; 6.5.1.8; 6.0.5.3-86o | — | No fix listed | CNA |
| SonicWall | SonicOSv | 6.5.0.2-8v_RC363 (VMWARE); 6.5.0.2.8v_RC367 (AZURE); 6.5.0.2.8v_RC368 (AWS); 6.5.0.2.8v_RC366 (HYPER_V) | — | No fix listed | CNA |
- SonicOS VendorSonicWall Affected up to 5.9.1.10; 6.2.7.3; 6.5.1.3; 6.5.2.2; 6.5.3.1; 6.2.7.8; 6.4.0.0; 6.5.1.8; 6.0.5.3-86o Fixed in — No fix listed CNA
- SonicOSv VendorSonicWall Affected 6.5.0.2-8v_RC363 (VMWARE); 6.5.0.2.8v_RC367 (AZURE); 6.5.0.2.8v_RC368 (AWS); 6.5.0.2.8v_RC366 (HYPER_V) Fixed in — No fix listed CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* | up to 5.9.1.10 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.0.5.3-86o:*:*:*:*:*:*:* | 6.0.5.3-86o | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.2.7.3:*:*:*:*:*:*:* | 6.2.7.3 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.2.7.8:*:*:*:*:*:*:* | 6.2.7.8 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.4.0.0:*:*:*:*:*:*:* | 6.4.0.0 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.5.1.3:*:*:*:*:*:*:* | 6.5.1.3 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.5.1.8:*:*:*:*:*:*:* | 6.5.1.8 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.5.2.2:*:*:*:*:*:*:* | 6.5.2.2 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.5.3.1:*:*:*:*:*:*:* | 6.5.3.1 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicosv:6.5.0.2-8v_rc363:*:*:*:*:vmware:*:* | 6.5.0.2-8v_rc363 | Vulnerable | SonicWall |
- cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* Versions up to 5.9.1.10 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.0.5.3-86o:*:*:*:*:*:*:* Versions 6.0.5.3-86o Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.2.7.3:*:*:*:*:*:*:* Versions 6.2.7.3 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.2.7.8:*:*:*:*:*:*:* Versions 6.2.7.8 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.4.0.0:*:*:*:*:*:*:* Versions 6.4.0.0 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.5.1.3:*:*:*:*:*:*:* Versions 6.5.1.3 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.5.1.8:*:*:*:*:*:*:* Versions 6.5.1.8 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.5.2.2:*:*:*:*:*:*:* Versions 6.5.2.2 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.5.3.1:*:*:*:*:*:*:* Versions 6.5.3.1 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicosv:6.5.0.2-8v_rc363:*:*:*:*:vmware:*:* Versions 6.5.0.2-8v_rc363 Vulnerable ·SonicWall
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:sonicwall:sonicosv:6.5.0.2.8v_rc366:*:*:*:*:hyper_v:*:* | 6.5.0.2.8v_rc366 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicosv:6.5.0.2.8v_rc367:*:*:*:*:azure:*:* | 6.5.0.2.8v_rc367 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicosv:6.5.0.2.8v_rc368:*:*:*:*:aws:*:* | 6.5.0.2.8v_rc368 | Vulnerable | SonicWall |
- cpe:2.3:o:sonicwall:sonicosv:6.5.0.2.8v_rc366:*:*:*:*:hyper_v:*:* Versions 6.5.0.2.8v_rc366 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicosv:6.5.0.2.8v_rc367:*:*:*:*:azure:*:* Versions 6.5.0.2.8v_rc367 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicosv:6.5.0.2.8v_rc368:*:*:*:*:aws:*:* Versions 6.5.0.2.8v_rc368 Vulnerable ·SonicWall
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-7475
- 2026-10-03 Alias added: GHSA-x6wv-vcm5-3f5j
References
More SonicWall Sonicos vulnerabilities
- TI-2020-04229 Buffer overflow in SonicWall SonicOS KEVCVSS 3.1CRITICAL 9.8
- TI-2024-35902 Improper authentication in SonicWall SonicOS KEVCVSS 3.1CRITICAL 9.8
- TI-2024-27152 Improper access control in SonicWall SonicOS KEVCVSS 3.1CRITICAL 9.8
- TI-2022-06604 Stack-based buffer overflow in SonicWall SonicOS CVSS 3.1CRITICAL 9.8
- TI-2019-09143 Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). CVSS 3.1CRITICAL 9.8
- TI-2019-09145 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. CVSS 3.1HIGH 8.8
Sources
- CVE-2019-7475 · CVE Program
- CVE-2019-7475 · NVD
- FIRST EPSS
- GHSA-x6wv-vcm5-3f5j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences