Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2024-12802

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sonicwall

Description

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SonicWall SonicOS

Default version status: unknown

  • 6.5.4.4-44v-21-2457 and older versionsaffected
  • 6.5.4.15-117n and older versionsaffected
  • 7.0.1-5161 and older versionsaffected
  • 7.1.1-7058 and older versionsaffected
  • 7.1.2-7019affected
  • 8.0.0-8035affected

References