Update: SonicWall Zero-Day Vulnerability

THE THREAT

On February 3rd, 2021, SonicWall released security patches to address critical zero-day vulnerabilities in their products. The vulnerabilities exist in the SonicWall Secure Mobile Access (SMA) 100 series 10.x code. While vulnerability details remain minimal, SonicWall has confirmed that one zero-day vulnerability is used to gain administrator credential access and a second vulnerability is used for remote code execution.

Organizations must address these vulnerabilities immediately as active exploitation is ongoing.

What we’re doing about it

• MVS has a remote plugin to identify vulnerable systems
  • MVS customers seeking assistance with their review or scans, please contact your MVS consultant or the eSentire Security Operations Center (SOC)
• eSentire security teams continue to track this topic for additional details and detection opportunities
• eSentire published an initial advisory on this topic on January 25th, 2021

What you should do about it

• After performing a business impact review, apply the SonicWall security patches (SMA 10.2.0.5-29sv firmware)
• Reset passwords for all users that have logged in to the device via the web interface
• Enable Multi-Factor Authentication (MFA) for all SonicWall SMA devices
• If mitigation actions are not feasible, evaluate business impact of restricting access to affected devices from untrusted networks until the issue is resolved

Additional information

Vulnerability details, including CVE numbers, are not publicly available at this time. Attacks exploiting this vulnerability in the wild have been confirmed against both SonicWall and SonicWall customers.

Known Impacted SonicWall Products (as of February 3, 2021):

• SMA 100 Devices with 10.x Firmware
• Physical Appliances: SMA 200, SMA 210, SMA 400, SMA 410
• Virtual Appliances: SMA 500v (Azure, AWS, ESXi, HyperV)

References:

[1] https://www.sonicwall.com/support/product-notification/urgent-security-notice-sonicwall-confirms-sma-100-series-10-x-zero-day-vulnerability-feb-1-2-p-m-cst/210122173415410/