Follow-Up: SonicWall Updates Advisories for Actively Exploited Vulnerabilities

In a previous security bulletin sent by Arctic Wolf on 17 April 2025, we advised of a credential access campaign targeting SonicWall SMA devices along with remediation guidance. As of 29 April 2025, SonicWall has updated their advisories for several vulnerabilities that are now linked to ongoing exploitation in the threat landscape. 

On the advisories for the two relevant vulnerabilities, CVE-2024-38475 and CVE-2023-44221, SonicWall updated the descriptions to indicate that they are potentially being exploited in the wild. For CVE-2023-44221, which allows for OS command injection, valid credentials are required for successful exploitation. 

Given that CVE-2023-44221 allows for OS command injection on affected devices, threat actors may utilise it to establish persistence on affected devices and to move laterally within compromised environments. 

It is important to note that even fully patched firewall devices may still become compromised if accounts use poor password hygiene. Details surrounding the tactics used in this campaign are limited at this time, but organisations should review the recommendations below for hardening the security of all local accounts on SonicWall SMA devices. 

Recommendations

Upgrade to Latest Fixed Version

See the updated advisory for the details provided below: 

Harden Security of Local Accounts on SonicWall SMA Devices

To protect against the malicious activities observed in this campaign, organisations should apply the following security best practices for firewalls: 

• Enable multi-factor authentication for all accounts (especially local accounts). 

• Consider resetting passwords of all local accounts on SonicWall SMA firewalls, ensuring that strong passwords are used across the board. 

• Limit VPN access to the minimum necessary accounts. 

• Remove or disable all unneeded accounts, including default admin accounts. 

Configure Log Monitoring for all Firewall Devices

To increase the likelihood of catching malicious activity early, ensure that syslog monitoring is configured for all of your organisation’s firewall devices using our provided documentation. 

References

• SonicWall Advisory SNWLID-2024-0018

• SonicWall Advisory SNWLID-2023-0018

Resources

Understand the threat landscape, and how to better defend your organisation, with the 2025 Arctic Wolf Threat Report

See how Arctic Wolf utilises threat intelligence to harden your attack surface and stop threats earlier and faster