Skip to content
OpenAdvisories
Unscored Public exploit CVE-2020-5148 EUVD-2020-26395GHSA-6q6g-vf9m-7mj7

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a pote…

Published Mar 5, 2021 · Updated Aug 4, 2024 · Assigned by sonicwall

Vendor: SonicWall Product: Directory Services Connector Category: Network devices

Description

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewall access controls.

Affected products

VendorProductAffectedFixed
SonicWall Directory Services Connector 4.1.17 and earlier —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • l0lsec/CVE-2020-5148 ★ 0 · Jul 25, 2026

    CVE-2020-5148 - Forced Authentication in the SonicWall UTM SSO Agent. The agent probes unvalidated workstations as Domain Admin, so one outbound web request yields a privileged NTLMv2 hash. Advisory …

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References