SonicWall: SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has warned of a new SSL-VPN flaw that allows bypassing multi-factor authentication (MFA), BleepingComputer reports. The vendor says the flaw is already exploited in attacks. Administrators should follow the official advisory and review VPN access for suspicious activity.
What happened
SonicWall has warned of a new flaw in its SSL-VPN remote access that lets attackers bypass multi-factor authentication (MFA). According to BleepingComputer, the vendor itself says the flaw is already used in real attacks. In practice, the second authentication factor can be skipped.
Why it matters
Companies running SonicWall firewalls with SSL-VPN may have remote access protected only by the main password. An attacker exploiting the flaw reaches the internal network without the second factor. This opens the door to data theft and account compromise.
What to do
Follow SonicWall's official advisory and apply the fix as soon as it is released. Review VPN access logs now for anomalous logins. Restrict VPN access to trusted sources until a fix is available.
For the technical team
- Affected
- SonicWall SSL-VPN · Affected products and versions not stated in the source. The flaw affects SonicWall SSL-VPN access.
- Exploitation
- Exploitation in attacks reported by SonicWall itself, according to BleepingComputer. No CVE, KEV or PoC cited in the source.
- Fix
- Not stated in the source. Follow SonicWall's official advisory.
- Vector
- Component: SonicWall SSL-VPN access. Failure type: multi-factor authentication (MFA) bypass. Exploitation condition: not stated in the source.
- More details
- Single source: BleepingComputer post on the vendor's advisory. No CVE, versions, dates or technical details disclosed so far.
Timeline
SonicWall advisory reports a new SSL-VPN MFA bypass flaw already exploited in attacks.
Sources 1 source
- @BleepinComputer @BleepinComputer
