VulnerabilityModified
CVE-2023-34124
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass.
CRITICAL 9.8EPSS 50.2%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 50.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 50.20% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-305, CWE-287
- Affected
- sonicwall/analytics · sonicwall/global management system
- Source
- PSIRT@sonicwall.com
References
- http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010Vendor Advisory
- https://www.sonicwall.com/support/notices/230710150218060Vendor Advisory
- http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010Vendor Advisory
- https://www.sonicwall.com/support/notices/230710150218060Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.