Critical Flaws Expose 25,000 SonicWall Devices to Hackers

Thousands of SonicWall network security devices remain exposed with critical security flaws, including 20,000 running outdated firmware that no longer receives vendor support.

See Also: On Demand | The Dark Side of AI: Unmasking its Threats and Navigating the Shadows of Cybersecurity in the Digital Age

A Bishop Fox report uncovered over 25,000 SonicWall SSLVPN devices exposed to the internet that could enable attackers to exploit known vulnerabilities, potentially leading to unauthorized access and data breaches. Despite patches being available for some of these flaws, many organizations continue to run outdated firmware, leaving their systems at risk.

Bishop Fox’s research examined more than 430,000 SonicWall devices globally and uncovered roughly 39% of the exposed devices are running on series 7 firewalls.

The study also found that over 20,000 of the devices are using firmware versions no longer supported by the vendor. Older series, particularly the 5 and 6 versions, are most at risk. But series 7 devices are lagging in applying the latest security patches, making them prime targets for cyberattacks, researchers said.

The findings come in the wake of a series of high-severity vulnerabilities disclosed earlier this year, including authentication bypasses and heap overflow vulnerabilities that affected a wide range of SonicWall firewall models, researchers said.

Bishop Fox used fingerprinting techniques to reverse-engineer the encryption protecting the SonicOSX firmware, helping them identify the specific versions and their exposure to known vulnerabilities.

Researchers found that many devices exposed to the internet are still vulnerable to flaws that could grant attackers unauthorized access to networks. A large number of targeted devices had both SSL VPN and management interfaces accessible, a configuration that should be avoided because it provides attackers with more avenues for infiltration.

While series 6 devices mostly run more recent firmware versions, they still have a high number of instances that are not fully patched. Similarly, many series 5 devices, which are mostly unsupported, continue to remain exposed to the internet, researchers said.

According to Bishop Fox, approximately 28% of the devices scanned have critical or high-severity vulnerabilities.

Businesses relying on SonicWall devices must ensure their firmware is up to date, Bishop Fox said.