Article
Five edge VPN flaws CISA flags for ransomware use
Five VPN and firewall flaws added to CISA KEV in 2025 and 2026 carry a ransomware flag. Dates, fixed versions and what to check…
Read more
Exploited vulnerability
SonicWall SonicOS SSLVPN authentication bypass (CVE-2024-53704)
CVE-2024-53704
CVE-2024-53704 is an authentication bypass in the SSLVPN service of SonicWall SonicOS, the operating system of SonicWall firewalls.
- On CISA KEV
- CVE ID
- CVE-2024-53704
- CISA KEV
- Listed
- Affected product
- SonicOS (SSLVPN) on Gen7 firewalls, Gen7 NSv and TZ80
- Exploited
- Yes
- Published
- January 2025
In short
CVE-2024-53704 is an authentication bypass in the SSLVPN service of SonicWall SonicOS, the operating system of SonicWall firewalls. An attacker can skip the login step of the VPN without valid credentials. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2024-53704
- ProductSonicWall SonicOS (SSLVPN) on Gen7 firewalls, Gen7 NSv and TZ80
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade the firmware · Limit or switch off SSLVPN
What it allows
A remote attacker can bypass authentication on the SSLVPN service. NVD scores it 9.8 out of 10 (CVSS v3.1). SonicWall scores it 8.2 (CVSS v3.0), rated high. SonicWall's advisory says the test code that abuses it leaves a recognisable log line.
Who is affected
Per SonicWall advisory SNWLID-2025-0003: Gen7 firewalls (TZ270 to TZ670, NSa 2700 to NSa 6700, NSsp 10700 to NSsp 15700) and Gen7 NSv (270, 470, 870) on 7.1.x up to 7.1.1-7058 and on 7.1.2-7019, plus TZ80 on 8.0.0-8035. Gen6 hardware on 6.5.x is not listed as affected for this CVE. SonicWall says SMA100 and SMA1000 SSL VPN products are not affected.
SonicWall published the advisory on 7 January 2025. On 30 January 2025 it added that public proof-of-concept code for CVE-2024-53704 was available and said this "significantly increases the risk of exploitation". Customers were told to update all unpatched 7.1.x and 8.0.0 firewalls at once. On 10 February 2025 it added indicators of compromise.
CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 18 February 2025, with a due date of 11 March 2025. The KEV entry flags known use in ransomware campaigns. The sources opened for this page do not give the date of the first attack.
The official sources opened (SonicWall, NVD, CISA) do not name who exploited the flaw, so this page does not attribute it to any group.
What to do
-
Upgrade the firmware
SonicWall names 7.0.1-5165 and higher, 7.1.3-7015 and higher, and for TZ80 8.0.0-8037 and higher. Do this first on firewalls that expose SSLVPN to the internet.
-
Limit or switch off SSLVPN
If you cannot patch now, SonicWall says to disable SSLVPN. Otherwise limit access to trusted sources and do not expose it to the whole internet.
-
Check SMA devices separately
The advisory says SMA100 and SMA1000 are not affected by this set of flaws, so do not count them as fixed or exposed because of this CVE.
-
Detect and hunt
Search the SSLVPN event log for the message that reads User, then the user name, then "Reuse SSLVPN session for the no. time(s)". SonicWall lists it as the sign seen when the public test code is used.
Questions
What is CVE-2024-53704?
It is an authentication bypass in the SSLVPN service of SonicWall SonicOS, the operating system of SonicWall firewalls. An attacker can skip the VPN login step without valid credentials. CISA lists it as exploited and flags known ransomware campaign use.
Which SonicWall products are affected by CVE-2024-53704?
Per advisory SNWLID-2025-0003, Gen7 firewalls and Gen7 NSv on 7.1.x up to 7.1.1-7058 and on 7.1.2-7019 are affected, plus TZ80 on 8.0.0-8035. Gen6 hardware on 6.5.x is not listed, and SMA100 and SMA1000 are not affected.
How do I protect against CVE-2024-53704?
Upgrade to 7.0.1-5165 or higher, 7.1.3-7015 or higher, or for TZ80 8.0.0-8037 or higher. If you cannot patch now, SonicWall says to disable SSLVPN or limit access to trusted sources instead of exposing it to the whole internet.
In our research
- Five edge VPN flaws CISA flags for ransomware use October 2026
Sources
- SNWLID-2025-0003 SonicOS Affected By Multiple Vulnerabilities SonicWall PSIRT
- CVE-2024-53704 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.