SonicWall SonicOS SSLVPN Improper Authentication Vulnerability
SonicWall · SonicOS
A flaw in the SSLVPN authentication mechanism of SonicWall SonicOS, the operating system for SonicWall's firewall appliances, is an Improper Authentication vulnerability. A remote attacker with network access to the SSLVPN service can bypass authentication without credentials or user interaction.
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 6/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 35 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 13 days after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+13 days
- First seen exploitedVulnCheck KEV evidence+35 days
- Added to CISA KEVknown ransomware use; EU database agrees+40 days
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
4 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 4Initial AccessTA0001
Due to improper session cookie validation in SonicOS, an attacker can hiijack an active session without any credentials.
Credential AccessTA0006
DiscoveryTA0007
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Remote Desktop ProtocolT1021.001 Windows-only technique on a non-Windows product
Detection
0 rules for this CVE · 72 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2024-53704 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Trusted RelationshipT11992 general rules
- Microsoft 365 - User Restricted from Sending Emailmediumtest
- Okta Session Impersonation Granted From Untrusted Domainmediumexperimental
Exploitation for Credential AccessT12125 general rules
- Audit CVE Eventcriticaltest
- GALLIUM IOCshightest
- Guacamole Two Users Sharing Session Anomalyhightest
- Kerberos Manipulationhightest
- Suspicious NTLM Authentication on the Printer Spooler Servicehightest
Cloud AccountsT1078.00441 general rules
- Application AppID Uri Configuration Changeshightest
- Application URI Configuration Changeshightest
- AWS IAM S3Browser LoginProfile Creationhightest
- AWS IAM S3Browser Templated S3 Bucket Policy Creationhightest
- AWS IAM S3Browser User or AccessKey Creationhightest
- Azure Subscription Permission Elevation Via ActivityLogshightest
- Changes To PIM Settingshightest
- Okta New Admin Console Behaviourshightest
File and Directory DiscoveryT108324 general rules
- Turla Group Lateral Movementcriticaltest
- WannaCry Ransomware Activitycriticaltest
- HackTool - PCHunter Executionhightest
- PUA - Seatbelt Executionhightest
- Shell Execution GCC - Linuxhightest
- Shell Execution via Find - Linuxhightest
- Shell Execution via Flock - Linuxhightest
- Shell Execution via Nice - Linuxhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- 44 more on OTX