CVE-2020-5135
SonicWall SonicOS Buffer Overflow Vulnerability
Description
CVE-2020-5135 is a critical buffer overflow vulnerability affecting SonicWall SonicOS (versions <= 6.0.5.3; >= 6.5.0.0, <= 6.5.1.11; >= 6.5.4.0, <= 6.5.4.7; 7.0.0.0). A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. CISA has added CVE-2020-5135 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 24.99% (96.1st percentile), this vulnerability has a significant probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sonicos | <= 6.0.5.3; >= 6.5.0.0, <= 6.5.1.11; >= 6.5.4.0, <= 6.5.4.7; 7.0.0.0 |
| sonicwall | sonicosv | <= 6.5.4.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0010(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5135(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Classic Buffer Overflow is a vulnerability that occurs when a program copies data to a buffer without first checking that the data fits within the buffer's allocated size. This typically happens when functions like strcpy(), gets(), sprintf(), or memcpy() are used without proper bounds checking. In the case of CVE-2020-5135, this weakness manifests in SonicWall SonicOS where a buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Impact Analysis
CVE-2020-5135 poses a critical threat to organizations running SonicWall SonicOS, with a CVSS score of 9.8 reflecting maximum impact across confidentiality, integrity, and availability. Successful exploitation can fully compromise the confidentiality, integrity, and availability of affected systems. Attackers can access sensitive data, modify system configurations or data, and disrupt service availability. The network-based attack vector requiring no authentication makes this vulnerability particularly accessible to opportunistic attackers and automated scanning tools.
Exploit Maturity
CVE-2020-5135 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 24.99% (96.1st percentile) indicates a significant probability of exploitation in the wild. The age of this vulnerability combined with its continued inclusion in the KEV catalog suggests that many organizations have yet to fully remediate it.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade SonicWall SonicOS from affected versions (<= 6.0.5.3; >= 6.5.0.0, <= 6.5.1.11; >= 6.5.4.0, <= 6.5.4.7; 7.0.0.0) to the latest patched release.
- If immediate patching is not possible, restrict network access to the affected SonicOS service using firewall rules, ACLs, or network segmentation to limit exposure to trusted networks only.
- Monitor affected systems for signs of compromise by reviewing security logs for anomalous activity, unauthorized access attempts, and unexpected system changes related to SonicOS.
- Verify the patch deployment across all instances of SonicWall SonicOS in your environment using vulnerability scanning to confirm no systems remain exposed.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-05 are addressed within the required timeframe.
Technical Details
CVE-2020-5135 is classified under CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')) affecting SonicWall SonicOS in versions <= 6.0.5.3; >= 6.5.0.0, <= 6.5.1.11; >= 6.5.4.0, <= 6.5.4.7; 7.0.0.0. A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. The vulnerability is exploitable remotely over the network, with low attack complexity, requiring no prior authentication. The CVSS 3.1 base score of 9.8 (CRITICAL) reflects high confidentiality impact, high integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2020-5135 being actively exploited?
Yes. CVE-2020-5135 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 24.99% (96.1st percentile) indicates a significant probability of exploitation.
What products are affected by CVE-2020-5135?
CVE-2020-5135 primarily affects SonicWall SonicOS, as well as Sonicwall Sonicosv. The affected versions include <= 6.0.5.3; >= 6.5.0.0, <= 6.5.1.11; >= 6.5.4.0, <= 6.5.4.7; 7.0.0.0. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2020-5135?
Apply updates per vendor instructions. Specifically, upgrade from the affected versions (<= 6.0.5.3; >= 6.5.0.0, <= 6.5.1.11; >= 6.5.4.0, <= 6.5.4.7; 7.0.0.0) to the latest patched release from SonicWall. As an interim measure, restrict network access to the affected service to trusted networks only.
How severe is CVE-2020-5135?
CVE-2020-5135 has a CVSS 3.1 score of 9.8, rated CRITICAL. This critical rating reflects the vulnerability's potential for complete system compromise. The inclusion in the CISA KEV catalog means organizations are required to remediate this vulnerability within the specified deadline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.