SonicWall SonicOS SSLVPN: no limit on MFA code attempts

Impact

SSLVPN does not limit how many MFA codes an authenticated user can try. Someone who already holds a valid password can keep guessing second-factor codes until one works. That defeats MFA on the VPN that may front cluster management access. The record gives no detail beyond this.

Who can reach it

Remote. The attacker needs valid first-factor credentials for the SSLVPN.

What to do

Upgrade SonicOS to the fixed firmware in SNWLID-2023-0005. That is a firewall firmware upgrade and reboot, or a failover to an HA peer. Until then, watch for repeated MFA failures and rotate any VPN passwords you suspect are exposed.

References

Related entries

• Insyde InsydeH2O (IhisiSmm SMI handler): A malicious host OS calls an Insyde SMI handler with malformed argumentsCVE-2023-22612 · Insyde InsydeH2O (IhisiSmm SMI handler)High
• Dell PowerEdge Server BIOS (privilege management): An improper privilege-management flaw in PowerEdge BIOSCVE-2023-32460 · Dell PowerEdge Server BIOS (privilege management)High
• Supermicro BMC web interface CGI endpoints on X11 and M11 based boards with BMC firmware before 3.17.02CVE-2023-33412 · Supermicro BMC web interface CGI endpoints on X11 and M11 based boards with BMC firmware before 3.17.02High
• Supermicro BMC configuration functionality on X11 and M11 based boards through firmware 3.17.02: Arbitrary commandCVE-2023-33413 · Supermicro BMC configuration functionality on X11 and M11 based boards through firmware 3.17.02High
• SonicWall SonicOS: authenticated SSL VPN user can elevate privileges inside the tunnelCVE-2023-41715 · SonicWall SonicOS SSL VPN (tunnel privilege management)High
• EDK II NetworkPkg (DHCPv6 DNS Servers option handling): A crafted DNS Servers option inside a DHCPv6 AdvertiseCVE-2023-45234 · EDK II NetworkPkg (DHCPv6 DNS Servers option handling)High