Four Critical SonicWall Vulnerabilities Patched

On July 12th, 2023, SonicWall published a security advisory detailing fifteen security vulnerabilities in Global Management Suite (GMS) and Analytics. Among these vulnerabilities, Arctic Wolf has highlighted four in this bulletin which received a Common Vulnerability Scoring System (CVSS) rating of critical. The following vulnerabilities can allow an unauthenticated threat actor to view, modify, or delete data that the application is able to access:

Additionally, these vulnerabilities can be exploited remotely, do not require user interaction, and are low-complexity. Although Arctic Wolf Labs has not observed a public Proof of Concept (PoC) exploit published or any active exploitation, threat actors are likely to develop exploits for these vulnerabilities due to the prevalence of these products and the level of access on a network a threat actor can achieve once compromised.

Recommendation

Apply the Latest Security Patches Released by SonicWall

Arctic Wolf strongly recommends updating to the following versions outlined in the table below to remediate the newly disclosed vulnerabilities.

Note: Arctic Wolf recommends following change management best practices for deploying security patches, including testing changes in a dev environment before deploying to production to avoid operational impact.

References

• SonicWall Notice
• SonicWall Security Advisory