Database/Firmware, BMC & network fabric
SonicWall SonicOS: unauthenticated stack overflow crashes the firewall
CVSS 7.5CVE-2023-0656Firmware, BMC & network fabriccurated
Impact
A remote, unauthenticated attacker triggers a stack-based buffer overflow that crashes the firewall. NSa hardware and NSv virtual firewalls are affected. A crashed edge firewall cuts off management access and any tenant traffic it carries. The record describes denial of service only.
Who can reach it
Unauthenticated remote attacker who can reach the firewall.
What to do
Flash the fixed SonicOS firmware listed in SonicWall advisory SNWLID-2023-0004. The appliance reboots during the upgrade.
References
Related entries
- SonicWall SonicOS: crafted request overflows a buffer and crashes the firewallCVE-2021-20027 · SonicWall SonicOSHigh
- Dell Enterprise SONiC OS (authentication component): Uncontrolled resource consumption in SONiC's authenticationCVE-2023-24574 · Dell Enterprise SONiC OS (authentication component)High
- AMI MegaRAC SPx (Redfish): Password disclosure through RedfishCVE-2023-25191 · AMI MegaRAC SPx (Redfish)High
- AMI MegaRAC SPx 12 (Service Location Protocol service): Every BMC running SLP is a free DDoS cannon pointedCVE-2023-29552 · AMI MegaRAC SPx 12 (Service Location Protocol service)High
- Supermicro BMC web server on X11 and M11 based boards with firmware up to 3.17.02: An unauthenticated attacker readsCVE-2023-33411 · Supermicro BMC web server on X11 and M11 based boards with firmware up to 3.17.02High
- Juniper Junos OS PFE on QFX10000 Series (VXLAN tunnel routing): A specific *valid* IP packet that needs to be routedCVE-2023-36835 · Juniper Junos OS PFE on QFX10000 Series (VXLAN tunnel routing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.