Medium WID-SEC-2023-2664 9 CVEs

SonicWall SonicOS: Mehrere Schwachstellen

Published Oct 16, 2023 · Updated Oct 16, 2023 · de-DE

Vendor: SonicWall Product: SonicOS Product: SonicOS < 6.5.4.13-105n Product: SonicOS < 6.5.4.4-44v-21-2340 Product: SonicOS < 7.0.1-5145

Summary

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in SonicWall SonicOS ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, Informationen offenzulegen oder seine Privilegien zu erweitern.

Product

SonicOS ist das Betriebssystem von SonicWall Firewall-Produkten.

Vulnerabilities 9

High 8.8

CVE-2023-41715

SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to e…

SonicWall SonicOS Network devices

Oct 17, 2023
Unscored —

CVE-2023-39276

SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to…

SonicWall SonicOS Network devices

Oct 17, 2023
Unscored —

CVE-2023-39277

SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL …

SonicWall SonicOS Network devices

Oct 17, 2023
Unscored —

CVE-2023-39278

SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi lead…

SonicWall SonicOS Network devices

Oct 17, 2023
Unscored —

CVE-2023-39279

SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint lead…

SonicWall SonicOS Network devices

Oct 17, 2023
Unscored —

CVE-2023-39280

SonicOS p ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoi…

SonicWall SonicOS Network devices

Oct 17, 2023
Unscored —

CVE-2023-41711

SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lea…

SonicWall SonicOS Network devices

Oct 17, 2023
Unscored —

CVE-2023-41712

SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads …

SonicWall SonicOS Network devices

Oct 17, 2023
Unscored —

CVE-2023-41713

SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.

SonicWall SonicOS Network devices

Oct 17, 2023

Revision history

2023-10-16 #1
Initiale Fassung

References

SonicWall Security Advisory - SNWLID-2023-0012 vom 2023-10-16
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0012