SonicWall CVE-2024-40766 is one of three actively exploited vulnerabilities that CISA added to its Known Exploited Vulnerabilities catalog, alongside flaws in ImageMagick and the Linux kernel. Federal civilian agencies must patch by September 30, 2024. The SonicWall flaw is an improper access control issue in SonicOS, and the post reports that ransomware groups associated with Akira have used it to gain initial access.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding the active exploitation of three critical vulnerabilities, which have been added to its Known Exploited Vulnerabilities (KEV) catalog. This warning emphasizes the urgent need for Federal Civilian Executive Branch (FCEB) agencies to patch affected systems by September 30, 2024, to protect against potential cyberattacks.
Exploited Vulnerabilities:
CVE-2016-3714 (CVSS 8.4): ImageMagick Remote Code Execution Flaw
This long-standing vulnerability in ImageMagick, a widely-used image processing library, allows attackers to remotely execute malicious code. The flaw arises from inadequate filename filtering during file conversions, making it a high-risk exploit.
CVE-2017-1000253 (CVSS 7.8): Linux Kernel Privilege Escalation
A buffer corruption vulnerability in the Linux kernel’s load_elf_binary() function allows local attackers to escalate their privileges. Exploiting this flaw could potentially give attackers full control of the system.
CVE-2024-40766 (CVSS 9.8 in NVD, 9.3 from a secondary source): How is SonicWall SonicOS exploited by Akira ransomware?
This critical vulnerability in SonicWall’s SonicOS has been exploited by ransomware groups, including those associated with the Akira ransomware. Threat actors have leveraged this flaw to gain initial access to networks, particularly targeting SonicWall Gen 5, Gen 6, and Gen 7 devices. Attacks on SonicWall SSLVPN accounts have continued, though the direct connection to CVE-2024-40766 remains circumstantial.
What has CISA told agencies to do?
CISA’s inclusion of these vulnerabilities in its KEV catalog reinforces the urgency for FCEB agencies to take immediate action. The agency has mandated a patch deadline of September 30, 2024, to mitigate potential risks associated with these actively exploited vulnerabilities.
What should other organizations do?
For Private Sector and Other Organizations: Review your systems for exposure to these vulnerabilities, particularly if using ImageMagick, Linux-based systems, or SonicWall devices. Apply available patches and monitor network activity for signs of compromise.
CISA’s alert serves as a critical reminder of the importance of timely patching and proactive vulnerability management to defend against evolving cyber threats.
Later flaws in SonicWall, Ivanti, WatchGuard, Palo Alto Networks and Check Point products that CISA also flagged for ransomware use are listed in Five edge VPN flaws CISA flags for ransomware use.