Database/Firmware, BMC & network fabric
SonicWall SonicOS: hard-coded password in a leftover demo function
Impact
SonicOS has a hard-coded password in the 'dynHandleBuyToolbar' demo function. The CVSS vector gives unauthenticated network access with high confidentiality impact and no integrity or availability impact, so the exposure is information disclosure from the firewall. The record does not say what data can be read. Firewalls and NSv instances at the datacenter edge hold network policy and VPN configuration, so a leak there helps an attacker map the management network.
Who can reach it
Anyone who can reach the SonicOS interface that exposes the demo function over the network. No authentication is needed.
What to do
Upgrade SonicOS to the fixed release in SonicWall advisory SNWLID-2023-0012; the record does not name the version. The upgrade reboots the appliance, so fail over an HA pair or schedule a window. Until then, restrict the firewall's management interfaces to trusted networks.
References
Related entries
- Juniper Junos OS Packet Forwarding Engine (MX Series): Improper handling of unusual conditions in the Packet ForwardingCVE-2023-44199 · Juniper Junos OS Packet Forwarding Engine (MX Series)High
- AMI AptioV UEFI BIOS (EDK II network stack, IPv6): An infinite loop when the firmware parses unknown options in an IPv6CVE-2023-45232 · AMI AptioV UEFI BIOS (EDK II network stack, IPv6)High
- EDK II NetworkPkg (IPv6 Destination Options header, PadN option parsing): Same shape as the unknown-option hang butCVE-2023-45233 · EDK II NetworkPkg (IPv6 Destination Options header, PadN option parsing)High
- EDK II NetworkPkg (TCP initial sequence number generation): The firmware's TCP initial sequence numbersCVE-2023-45236 · EDK II NetworkPkg (TCP initial sequence number generation)High
- EDK II NetworkPkg (PseudoRandom number generation used by the network stack): The weak PRNG behind the previous issueCVE-2023-45237 · EDK II NetworkPkg (PseudoRandom number generation used by the network stack)High
- Lenovo XClarity Controller (XCC) - permission API: An authenticated XCC user can change the permissions of any userCVE-2023-4607 · Lenovo XClarity Controller (XCC) - permission APIHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.