VulnerabilityModified

CVE-2023-6340

The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability.

MEDIUM 5.5EPSS 0.21%

Does this matter?

Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.

Description

SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability.

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.21% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-121, CWE-787
Affected: sonicwall/capture client · sonicwall/netextender
Source: PSIRT@sonicwall.com

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0019Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0019Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.