CVE-2024-53704
SonicWall SonicOS SSLVPN Improper Authentication Vulnerability
Description
CVE-2024-53704 is a critical improper authentication vulnerability in the SonicWall SonicOS SSLVPN authentication mechanism that allows a remote attacker to completely bypass authentication. Rated with a CVSS v3.1 base score of 9.8, this vulnerability requires no privileges, no user interaction, and is exploitable over the network with low complexity. CISA has added CVE-2024-53704 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 11, 2025, and critically, the ransomware exploitation status is marked as Known, confirming that this vulnerability is being actively used in ransomware campaigns. The EPSS score of 93.86% at the 99.9th percentile places this among the most actively exploited vulnerabilities tracked globally.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sonicwall | sonicos | >= 7.1.1-7040, <= 7.1.1-7058; 7.1.2-7019; 8.0.0-8035 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53704(US Government Resource)
Weakness Type
Improper Authentication
CVE-2024-53704 is classified as an improper authentication vulnerability in the SonicWall SonicOS SSLVPN mechanism. Improper authentication occurs when a system does not adequately verify the identity of users before granting access, allowing unauthorized actors to bypass the authentication process entirely. In SonicOS, the SSLVPN authentication mechanism contains a flaw that enables a remote attacker to circumvent the login verification process, gaining unauthorized VPN access to the protected network without providing valid credentials.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2024-53704 represents one of the most severe network perimeter vulnerabilities currently being exploited. The vulnerability is exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N). Confidentiality (High): Bypassing SSLVPN authentication grants the attacker full VPN access to the internal network, exposing all resources accessible through the VPN tunnel. This includes internal servers, databases, file shares, application backends, and any other network-connected systems. The attacker effectively gains the same network position as a legitimate remote employee. Integrity (High): With VPN-level network access, an attacker can modify internal resources, deploy malware, alter configurations, manipulate data, and establish persistent access across the internal network. The trust boundary violation is catastrophic because VPN access is typically granted broad internal network permissions. Availability (High): Full network access enables the attacker to disrupt services, deploy ransomware, encrypt critical systems, and cause widespread operational disruption. The EPSS score of 93.86% at the 99.9th percentile confirms near-certain exploitation, and the ransomware status is Known — meaning this vulnerability is actively being leveraged in ransomware attacks against organizations. This makes CVE-2024-53704 an immediate, existential threat to any organization running affected SonicWall firmware.
Exploit Maturity
CVE-2024-53704 has reached maximum exploit maturity with confirmed ransomware exploitation. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 11, 2025, and has specifically marked the ransomware use status as Known, confirming active use in ransomware campaigns. SonicWall has published a security advisory (SNWLID-2025-0003) providing remediation guidance. The EPSS score of 93.86% at the 99.9th percentile places this vulnerability in the top 0.1% of all tracked CVEs for exploitation probability, confirming that it is among the most actively targeted vulnerabilities in the current threat landscape. The combination of authentication bypass on a VPN appliance and confirmed ransomware use makes this an exceptionally dangerous vulnerability that threat actors are systematically exploiting across the internet.
Remediation
-
Update SonicOS firmware immediately. Apply the patched firmware versions as specified in the SonicWall security advisory SNWLID-2025-0003. Affected versions include SonicOS 7.1.1-7040 through 7.1.1-7058, 7.1.2-7019, and 8.0.0-8035. Upgrade to the latest available firmware that addresses CVE-2024-53704.
-
Disable SSLVPN if patching cannot be performed immediately. If an immediate firmware upgrade is not possible, temporarily disable the SSLVPN functionality on all affected SonicWall appliances. This eliminates the attack surface while the upgrade is being planned and tested.
-
Audit VPN access logs for unauthorized sessions. Review SSLVPN authentication and session logs for any evidence of unauthorized access, including sessions from unexpected IP addresses, abnormal connection times, and unusual data transfer patterns. Cross-reference with your organization's legitimate user activity.
-
Conduct a full network compromise assessment. Given the confirmed ransomware exploitation of CVE-2024-53704, assume breach if your SonicWall appliance was exposed with the SSLVPN enabled. Perform a thorough forensic investigation of internal systems, looking for lateral movement indicators, deployed malware, modified credentials, and ransomware staging artifacts.
-
Implement defense-in-depth for VPN access. Deploy multi-factor authentication (MFA) for all VPN connections, implement network segmentation to limit VPN access to only necessary resources, enable enhanced logging and monitoring on the SonicWall appliance, and consider implementing a zero-trust network access (ZTNA) solution as a long-term replacement for traditional VPN.
Technical Details
CVE-2024-53704 is an improper authentication vulnerability in the SSLVPN authentication mechanism of SonicWall SonicOS. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects maximum exploitability: Attack Vector (Network): The vulnerability is exploitable remotely through the SSLVPN interface, which is inherently internet-facing. Attack Complexity (Low): Exploitation is straightforward and does not require specialized conditions or timing. Privileges Required (None): No authentication credentials are needed — this is a complete authentication bypass. User Interaction (None): The attack is fully automated with no user involvement required. Impact (High across all dimensions): Successful bypass grants full VPN access with maximum impact to confidentiality, integrity, and availability of the internal network. The affected versions include SonicOS 7.1.1-7040 through 7.1.1-7058, version 7.1.2-7019, and version 8.0.0-8035. The SSLVPN authentication mechanism in these versions contains a flaw in its credential verification process that allows a remote attacker to craft requests that are accepted without proper authentication. This bypasses the entire SSLVPN login flow, granting the attacker an authenticated VPN session and full tunnel access to the internal network. The authentication bypass operates at the protocol level within the SSLVPN subsystem, meaning traditional web application firewalls or IDS signatures may not detect the exploitation without specific signatures targeting this vulnerability.
Frequently Asked Questions
Is CVE-2024-53704 being used in ransomware attacks?
Yes. CISA has marked the ransomware exploitation status as Known for CVE-2024-53704, confirming that threat actors are actively using this vulnerability in ransomware campaigns. The authentication bypass provides attackers with VPN access to internal networks, which is then leveraged for lateral movement and ransomware deployment.
What products are affected by CVE-2024-53704?
CVE-2024-53704 affects SonicWall SonicOS firmware versions 7.1.1-7040 through 7.1.1-7058, version 7.1.2-7019, and version 8.0.0-8035. All SonicWall appliances running these firmware versions with SSLVPN enabled are vulnerable to the authentication bypass.
How do I fix CVE-2024-53704?
Update your SonicWall appliance to the latest patched firmware as specified in SonicWall security advisory SNWLID-2025-0003. If immediate patching is not possible, disable the SSLVPN functionality as a temporary mitigation. Additionally, audit VPN logs for unauthorized access and conduct a compromise assessment.
Can CVE-2024-53704 be exploited without any credentials?
Yes. CVE-2024-53704 is a complete authentication bypass requiring no credentials, no privileges, and no user interaction. Any attacker who can reach the SonicWall SSLVPN interface over the network can exploit this vulnerability to gain full VPN access to the protected internal network.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.