SonicWall has warned customers about some serious vulnerabilities in the company 's Global Management System (GMS) firewall and Analytics network reporting engine software suites and urged them to apply security updates immediately .
The company fixed 15 vulnerabilities. Some of them could allow attackers to gain access to vulnerable on-prem systems running GMS 9.3.2-SP1 or earlier and Analytics 2.5.0.4-R7 or earlier, after bypassing authentication.
SonicWall says that four of the vulnerabilities have been rated critical, as they allow an attacker to bypass authentication and could potentially lead to the exposure of sensitive information.
See also: Microsoft Patch Tuesday July 2023: Fixes 132 vulnerabilities
The vulnerabilities that customers must immediately fix by upgrading to GMS 9.3.3 and Analytics 2.5.2 are as follows:
- CVE-2023-34124: Web Service Authentication Bypass
- CVE-2023-34133: Unauthenticated SQL Injection Issues & Security Filter Bypass
- CVE-2023-34134: Password Hash Read via Web Service
- CVE-2023-34137: CAS Authentication Bypass
They can be used remotely by unverified threat and do not require user interaction.
According to SonicWall, successful exploitation allows unauthorized access to data.
See also: Apple fixes new zero-day vulnerability
This data may include information belonging to other users or any data within the scope of the compromised application. Attackers can then use or delete this data, making substantial changes to the content or functionality of the compromised application.
The company's devices are a favorite target for cybercriminals. Many ransomware (e.g. HelloKitty, FiveHands, etc.) have targeted vulnerabilities in SonicWall products to carry out attacks.
For example, in March, SonicWall and Mandiant revealed that suspected Chinese hackers installed custom malware on unpatched SonicWall Secure Mobile Access (SMA) devices for cyberespionage.
See also: Android: July security updates fix 46 vulnerabilities
SonicWall is a leading cybersecurity provider offering a broad range of solutions designed to meet the needs of both small and large businesses. Its products are used by more than 500,000 business customers worldwide, including government agencies and large corporations.
Source: www.bleepingcomputer.com
