PT-2023-3990 · Sonicwall · Sonicwall Analytics+1

Published 2023-07-12 · Updated 2023-09-29 · CVE-2023-34137

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SonicWall GMS versions 9.3.2-SP1 and earlier SonicWall Analytics versions 2.5.0.4-R7 and earlier

Description The issue is related to an authentication bypass vulnerability in the SonicWall Analytics and SonicWall Global Management System (GMS) due to the use of static values for authentication without proper checks. This allows a remote attacker to execute arbitrary code. The vulnerability affects the CAS Web Services application.

Recommendations For SonicWall GMS versions 9.3.2-SP1 and earlier, update to a version later than 9.3.2-SP1 to resolve the issue. For SonicWall Analytics versions 2.5.0.4-R7 and earlier, update to a version later than 2.5.0.4-R7 to resolve the issue. As a temporary workaround, consider restricting access to the CAS Web Services application until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-305

Related Identifiers

BDU:2023-04288

CVE-2023-34137

Affected Products

Sonicwall Analytics

Sonicwall Gms

References · 10

• https://osv.dev/vulnerability/CVE-2023-34137 · Vendor Advisory
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04288 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34137 · Security Note
• https://sonicwall.com/support/notices/230710150218060 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/696921/?sphrase_id=45540 · Security Note
• https://twitter.com/CCBalert/status/1707763263428080070 · Twitter Post
• https://t.me/true_secator/4611 · Telegram Post
• https://t.me/cibsecurity/66629 · Telegram Post
• https://t.me/cvenotify/54209 · Telegram Post