SonicWall confirmed that the old version of their OS has been reviewed to be vulnerable to remote attackers through their official statements. After extensive research, they acknowledged the weakness and immediately performed a mitigation plan to develop an immediate patch to resolve the issue.
Dubbed as CVE-2020-5135, this issue will allow an adversary to run malicious code on exploited devices and use it for their perusal. As reported, it is a flaw in the buffer overflow of the SonicWall OS that is open to be injected with malicious code. The adversary can manipulate infected devices via remote access control.
With the ongoing pandemic and immediate rise in many businesses doing transactions online or working from home, this ethical hacking report from concerned cybersecurity experts is a vital discovery for SonicWall company. For their business-focused services of providing network firewalls and secured VPN connection, the information saved the company from a large magnitude of damage and loss of profit. Based on the company records, over 800,000 devices are deployed and working on the old version of SonicWall OS that is susceptible to the reported vulnerability.
Following are the lists of the affected SonicWall OS and required update to address the known issue:
SonicOS 6.5.4.7-79n and earlier – Upgrade to SonicOS 6.5.4.7-83n
SonicOS 6.5.1.11-4n and earlier – Upgrade to SonicOS 6.5.1.12-1n
SonicOS 6.0.5.3-93o and earlier – Upgrade to SonicOS 6.0.5.3-94o
SonicOSv 6.5.4.4-44v-21-794 and earlier – Upgrade to SonicOS 6.5.4.v-21s-987
SonicOS 7.0.0.0-1 – Upgrade to Gen 7 7.0.0.0-2 and onwards
Initial investigation of SonicWall confirmed that the malicious code injection can result in devices to stop working, resulting in a lot Distributed-Denial-of-Service (DDoS) and cross-site scripting exploitation. Thus, upon confirming the reliability of the submitted report, patches have been developed. A circular has been released by the company to its customers to order for the immediate OS upgrade.
SonicWall is very thankful for such an act of the researchers that exposed the flaw. This may result in far more damage to the company and its customers that expect a more secure environment connection due to the current situation. With the submitted report, SonicWall also discovered other flaws with the old OS and had immediately incorporated resolution to release a patch upgrade. Their latest statement confirmed that they have found no trace that an adversary may have used the discovered vulnerability. A full report about this will be released for public knowledge once their customers have already adopted the new security upgrade.
Such concern about ethical hacking is an attitude that the cyber community needs, especially when many blackhats take advantage of the current pandemic situation. To protect the community, everyone is expected to be more vigilant and proactively seek the latest technology to pre-empt this advancement regarding fraudulent activities.
