SonicWall SonicOS: authenticated SSL VPN user can elevate privileges inside the tunnel

CVSS 8.8CVE-2023-41715Firmware, BMC & network fabriccurated

Impact

A user with valid SSL VPN credentials can gain privileges inside the tunnel beyond the ones assigned to them. Where a SonicWall firewall or NSv virtual firewall is the remote-access path into a datacenter management network, a low-privilege VPN account (a contractor, a tenant support login) could reach more than its policy allows, possibly BMC, switch or cluster-management segments. The advisory record does not say which privileges are gained or how far the escalation goes.

Who can reach it

Any authenticated SSL VPN user over the network. Valid VPN credentials are required; no user interaction.

What to do

Upgrade SonicOS to the fixed release listed in SonicWall advisory SNWLID-2023-0012; the record does not name the version. A firmware upgrade reboots the appliance, so plan a failover on an HA pair or a maintenance window for the VPN/edge path. Until patched, review and limit SSL VPN account access.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-41715 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.