# CVE-2024-40766

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

- Page: https://www.vulneraibility.com/cve/CVE-2024-40766
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2024-09-09; CISA due date 2024-09-30; known ransomware use
- EPSS: 18.38%
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2024-09-09)
- Weakness: CWE-284
- Published: 2024-08-23

## Affected versions

- SonicWall SonicOS: affected 5.9.2.14-12o and older versions; 6.5.4.14-109n and older versions; 7.0.1-5035 and older versions

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.