PT-2019-18617 · Sonicwall · Sonicos+1
Published
2019-04-02
·
Updated
2020-10-06
·
CVE-2019-7474
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
SonicWall SonicOS versions prior to 5.9.1.10
SonicWall SonicOS Gen 6 versions 6.2.7.3, 6.4.0.0, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.0.5.3-86o
SonicWall SonicOSv versions 6.5.0.2-8v RC363, 6.5.0.2.8v RC367, 6.5.0.2.8v RC368, 6.5.0.2.8v RC366
Description
A vulnerability in SonicWall SonicOS and SonicOSv allows an authenticated read-only admin to leave the firewall in an unstable state by downloading a certificate with a specific extension.
Recommendations
For SonicWall SonicOS versions prior to 5.9.1.10, update to a version later than 5.9.1.10 to resolve the issue.
For SonicWall SonicOS Gen 6 versions 6.2.7.3, 6.4.0.0, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.0.5.3-86o, update to a version that is not affected by this vulnerability.
For SonicWall SonicOSv versions 6.5.0.2-8v RC363, 6.5.0.2.8v RC367, 6.5.0.2.8v RC368, 6.5.0.2.8v RC366, update to a version that is not affected by this vulnerability.
As a temporary workaround, consider restricting access to certificate downloads for read-only admins until a patch is available.
Fix
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sonicos
Sonicos Gen 6