{"id":"CVE-2024-40766","published":"2024-08-23T07:15:03Z","modified":"2026-09-21T21:17:02Z","title":"SonicWall SonicOS Improper Access Control Vulnerability","vendor":"SonicWall","product":"SonicOS","tier":"core","eol":null,"description":{"text":"An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper access control vulnerability in the management access component of SonicWall SonicOS, affecting SonicWall Firewall Gen 5 and Gen 6 devices and Gen 7 devices running SonicOS 7.0.1-5035 and older. An attacker reaching the management interface over the network without authentication or user interaction can gain unauthorized access to resources and, under specific conditions, crash the firewall.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:02:53Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.18379,"percentile":0.97221,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-09-09","dueDate":"2024-09-30","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015; https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40766","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-04-23","exploitedFirstSeen":"2024-04-23","ransomware":true,"evidence":[{"url":"https://www.fortiguard.com/outbreak-alert/akira-ransomware","date":"2024-04-23"},{"url":"https://arcticwolf.com/resources/blog/arctic-wolf-observes-akira-ransomware-campaign-targeting-sonicwall-sslvpn-accounts/","date":"2024-09-06"},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015","date":"2024-09-06"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-09-09"},{"url":"https://www.cyfirma.com/research/tracking-ransomware-september-2024/","date":"2024-10-10"},{"url":"https://www.guidepointsecurity.com/wp-content/uploads/2021/07/Q3-2024_Ransomware_and-Cyber_Threat_Insights.pdf","date":"2024-10-21"},{"url":"https://blog.polyswarm.io/the-evolution-of-akira-ransomware","date":"2024-11-01"},{"url":"https://www.dragos.com/blog/dragos-industrial-ransomware-analysis-q3-2024/","date":"2024-12-17"},{"url":"https://security.macnica.co.jp/en/blog/2024/12/akira-fog-exploit-sonicwall-nsa-cve-2024-40766-where-patching-stands.html","date":"2024-12-27"},{"url":"https://www.reliaquest.com/blog/ransomware-and-cyber-extortion-in-q4-2024/","date":"2025-01-15"}],"evidenceTotal":75,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers","url":"https://otx.alienvault.com/pulse/6ad8700a0fe145230ba94c11","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated exploit of exposed management interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"improper access control vulnerability has been identified in the SonicWall SonicOS management access","start":3,"end":103}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthorized access enables reading local resources","mappingType":"primary_impact","evidence":[{"from":"description","quote":"potentially leading to unauthorized resource access","start":105,"end":156}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Crash of firewall causes application or system DoS","mappingType":"primary_impact","evidence":[{"from":"description","quote":"causing the firewall to crash","start":185,"end":214}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-38613","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38613","exploited":true,"exploitedSince":"2024-09-09","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005","T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2024-04-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortiguard.com/outbreak-alert/akira-ransomware","provenance":"source"},{"date":"2024-08-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40766","provenance":"source"},{"date":"2024-09-09","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-09-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38613","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":17},"priority":{"score":74.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 920 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.44,"detail":"percentile 0.9722"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}