Μια κρίσιμη ευπάθεια που επηρεάζει τις πύλες ασφαλούς πρόσβασης για κινητά (SMA) της SonicWall, η οποία αντιμετωπίστηκε τον περασμένο μήνα, γίνεται τώρα στόχος εκμετάλλευσης.
See also: Hackers steal cryptocurrency using fake MetaMask extension
The bug, identified by Rapid7's lead security researcher Jacob Baines, is an unauthenticated buffer overflow, referenced as CVE-2021-20038 , and affects SMA 100 series devices, including SMA 200, 210, 400, 500v, even when the web application firewall (WAF) is enabled.
Successful exploitation can allow unauthenticated remote attackers to execute code as the “none” user on compromised SonicWall devices.
“There are no interim mitigations. SonicWall urges affected customers to apply applicable patches as soon as possible,” the company said in December after the release of the CVE-2021-20038, adding that it had found no evidence that the flaw had been exploited until then.
However, today, Richard Warren, Principal Security Advisor at NCC Group, said that malicious users are now trying to exploit the vulnerability.
See also: Apple: Fixes DoorLock bug that disables iPhones and iPads
Warren added that attackers are also trying to infiltrate via brute force attacks, targeting known default passwords of SonicWall devices.
"Remember to update AND change the default password," the security researcher tweeted.
Although these ongoing attacks have not yet been successful, SonicWall customers are advised to update their SMA 100 devices to prevent intrusion attempts.
SMA 100 users are advised to log in to their MySonicWall.com to upgrade the firmware to versions described in this SonicWall PSIRT Advisory.
SonicWall SMA 100 devices have been targeted in multiple campaigns since early 2021, including attacks coordinated by ransomware gangs.
See also: Central Bank of Indonesia: Victim of Conti ransomware?
In July, SonicWall warned of the increased risk of ransomware attacks targeting unpatched SMA 100 series products and Secure Remote Access products at the end of their life.
More than 500,000 business customers from 215 countries use SonicWall products worldwide, many of which have been deployed in government networks and the world’s largest companies.
