CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration., (Tue, Jun 23rd)

1. Executive summary

CVE-2024-40766 is an improper access control vulnerability in SonicOS (CVSS 9.3) affecting the management interface and SSLVPN service on SonicWall Gen 5, Gen 6 and Gen 7 firewalls. Successful exploitation grants unauthorised access and, under certain conditions, crashes the device. Akira (MITRE G1024) and Fog ransomware operators have exploited the vulnerability continuously since at least September 2024, with documented dwell times as short as 55 minutes from initial access to encryption. A second vulnerability, CVE-2024-12802, enables MFA bypass on Gen 6 devices and requires six manual LDAP reconfiguration steps beyond the firmware patch. Gen 6 hardware reached end-of-life on 16 April 2026; no further patches will be issued. EMEA financial services firms running SonicWall SSLVPN — particularly those that applied the firmware patch without completing post-patch hardening — face an active, well-understood ransomware intrusion path with credential reuse, stale local accounts, and exposed Virtual Office Portal endpoints.

2. Regulatory framing

Article	Trigger	Practical impact
DORA Art. 17	Active exploitation of SonicWall SSLVPN by named ransomware groups constitutes an ICT-related incident requiring a documented management process.	Maintain a tested incident response runbook covering SonicWall SSLVPN compromise, including credential rotation, session termination, and forensic preservation.
DORA Art. 18	Confirmed Akira/Fog intrusions with sub-four-hour dwell times require classification against ICT-related incident and cyber-threat taxonomy.	Classify any SonicWall SSLVPN compromise with confirmed unauthorised access as a major ICT-related incident; document severity criteria and escalation thresholds.
DORA Art. 19	Major ICT-related incidents involving SonicWall SSLVPN exploitation trigger competent-authority reporting obligations.	Establish reporting templates and timelines aligned to competent authority expectations for ransomware-related perimeter device compromise.
DORA Art. 24	Post-patch hardening requires digital operational resilience testing of perimeter devices.	Include SonicWall SSLVPN appliances in scope of resilience testing programmes; verify configuration hardening is tested, not only firmware version.
DORA Art. 28	SonicWall is an ICT third-party provider; the MySonicWall backup breach (September 2025) exposed encrypted credentials for all customer backups.	Treat SonicWall as a concentration-risk third party; reassess vendor risk profile and contractual remedies following the backup exposure.
DORA Art. 29	SonicWall SSLVPN is widely deployed as the sole remote-access method; this constitutes ICT concentration risk.	Document concentration exposure; identify fallback access paths and migration options, particularly for Gen 6 hardware now past end-of-life.
DORA Art. 30	Contractual provisions with SonicWall must reflect the post-EOL status of Gen 6 and the MySonicWall backup exposure.	Review contracts for support obligations, breach notification, and liability terms covering the September 2025 backup exposure and Gen 6 EOL.
NIS2 Art. 21(2)(d)	SonicWall supply-chain compromise (MySonicWall backup breach) requires supply-chain security measures.	Apply enhanced due diligence to SonicWall-sourced credentials and configurations; rotate all credentials potentially exposed via MySonicWall backups.
NIS2 Art. 23	SonicWall SSLVPN compromise with confirmed unauthorised access triggers incident reporting obligations.	Ensure early-warning and incident notification timelines account for SonicWall perimeter device compromise.
UK NIS 2018	Operators of Essential Services and Relevant Digital Service Providers using SonicWall SSLVPN have duties regarding network and information system security.	Confirm SonicWall appliances fall within OES/RDSP scope; apply appropriate security and incident notification duties.

3. Technical analysis & attack chain

Vulnerability mechanism (CVE-2024-40766): Improper access control in SonicOS affecting the management interface and SSLVPN service. Affected firmware ranges:

Gen 5: SonicOS 5.9.2.14-12o and older
Gen 6: SonicOS 6.5.4.14-109n and older
Gen 7: SonicOS 7.0.1-5035 and older

Vulnerability mechanism (CVE-2024-12802): Authentication bypass allowing MFA bypass on SonicWall SSLVPN. On Gen 6 devices, the firmware patch alone does not remediate the flaw; six manual LDAP reconfiguration steps are required (delete existing LDAP configuration using userPrincipalName, remove locally cached LDAP users, remove configured SSL VPN User Domain, reboot, recreate LDAP configuration without userPrincipalName, create fresh configuration backup).

Attack chain (confirmed steps)

Reconnaissance: Attackers identify SonicWall SSLVPN endpoints exposed to the internet. By December 2024, at least 48,933 devices were publicly exposed and unpatched.
Initial access — credential-based: Attackers authenticate using valid credentials obtained from prior compromise, the MySonicWall backup breach (September 2025), or brute-force automation. Huntress documented over 100 SSLVPN accounts compromised across 16 environments in a single October 2025 wave; attackers authenticated rapidly without brute-force indicators.
Initial access — exploit-based: CVE-2024-40766 exploitation grants unauthorised access to the firewall management interface or SSLVPN service.
MFA bypass: On Gen 6 devices, CVE-2024-12802 allows MFA bypass. Attackers brute-force credentials with automated tooling, bypass MFA without triggering failed-login alerts, and reach internal targets within 30 minutes of VPN access in observed cases.
Virtual Office Portal abuse: Where the SonicWall Virtual Office Portal is internet-exposed without authentication gating, attackers enroll their own TOTP device for compromised accounts, completing MFA challenges on attacker-controlled devices.
Persistence via stale accounts: Stale local SSLVPN accounts (not present in Active Directory) remain valid post-patch. Sessions on these accounts persist for 4–7 days; the firmware patch does not terminate them.
Lateral movement: VPN tunnel provides access to internal networks. Attackers reach file servers and deploy pre-ransomware staging tools.
Impact: Ransomware deployment. Arctic Wolf documented encryption occurring in under four hours from initial access, with some cases as fast as 55 minutes. Akira accounted for approximately 75% of intrusions; Fog approximately 25%.

Post-patch misconfiguration findings (from audited environments)

Stale local accounts: 12 of 14 audited firewalls had SSLVPN accounts not present in Active Directory. Some accounts contained non-printable characters — a strong indicator of automated account creation by exploitation tooling.
Unrotated passwords: 11 of 14 firewalls had not rotated local account passwords after firmware upgrade. Credentials potentially exposed via CVE-2024-40766 or the MySonicWall backup incident remain valid.
No source-IP restriction: 10 of 14 firewalls accepted VPN connections from any IP without geo-IP filtering or ASN blocking.
Default LDAP User Group overpermission: 9 of 14 firewalls had the Default LDAP User Group mapped to groups granting SSLVPN access or administrative access. In one case, the default group granted both SSLVPN Services and firewall management admin access — any compromised AD credential yields VPN tunnel plus perimeter admin.
Virtual Office Portal exposure: 50% of audited firewalls had the Virtual Office Portal accessible from the internet without authentication gating, enabling self-service TOTP enrollment.
Long-lived sessions on stale accounts: Sessions lasting 4–7 days observed on accounts disabled in AD over a year prior; sessions remained active on patched firewalls.

Unconfirmed or single-sourced claims: The exact attribution split between Akira and Fog (75%/25%) is sourced to Arctic Wolf/Huntress/Bitdefender analyses; specific organisational attribution beyond the named groups is not confirmed. The September 2025 MySonicWall breach scope (initially stated as <5% of customers, later revised to all backup files) is per SonicWall's own statements.

4. Mitigation & containment

P1 — Within 24 hours

Restrict Virtual Office Portal access. Create an access rule permitting the Virtual Office Portal only from internal network addresses or VPN-connected sources. This blocks self-service TOTP enrollment by attackers with valid credentials.
Enable account lockout and botnet filtering. Navigate to Device > Users > Settings > Account Lockout and Policy > Security Services > Botnet Filter. Enable lockout with thresholds ≤20 attempts. Enable botnet filtering on the SSLVPN zone.
Terminate stale sessions. Navigate to Network > SSL VPN > Status (SonicOS 7.x). Export session data, identify sessions >24 hours or from hosting/VPS ASNs, and terminate them.
Restrict management interface access. Restrict firewall management to management-VLAN-only access. Remove any internet-facing admin interface rules.

P2 — Within 72 hours

Reconcile local SSLVPN accounts. Navigate to Device > Users > Local Users & Groups (SonicOS 7.x). Compare against Active Directory export. Remove any account not in AD. Flag accounts with non-printable characters as compromise indicators.
Reconfigure Default LDAP User Group. Navigate to Device > Users > Settings > Authentication, select LDAP + Local Users, then Configure LDAP. Create a dedicated local group with no service access; set as Default LDAP User Group. Assign SSLVPN permissions explicitly only to groups requiring access.
Rotate all credentials. Rotate local firewall account passwords and LDAP-synchronized AD account passwords, including the LDAP bind credential. This applies regardless of whether the firmware patch was applied previously.
Implement source-IP restriction. Apply ASN or geo-IP filtering to SSLVPN authentication. Legitimate remote workers connect from residential ISPs in the country of operation; block hosting provider and VPS ASNs.

P3 — Within 7 days

Upgrade firmware. Upgrade to SonicOS 7.3.0 or later, which includes enhanced brute-force detection and improved MFA controls. Verify running version via Device > Settings > Firmware & Backups.
Gen 6 LDAP remediation (if applicable). Verify all six LDAP remediation steps from SNWLID-2025-0001 are completed: delete existing LDAP configuration using userPrincipalName, remove locally cached LDAP users, remove configured SSL VPN User Domain, reboot, recreate LDAP configuration without userPrincipalName, create fresh configuration backup. Firmware version alone does not confirm remediation on Gen 6.
Plan Gen 6 migration. Gen 6 reached end-of-life on 16 April 2026. No further firmware updates or security patches will be issued. Initiate migration planning to supported hardware.
Conduct forensic review. Navigate to Device > Diagnostics (SonicOS 7.x). Review saved packet captures, debug logs, and config exports created during the compromise window. Captures targeting LDAP bind traffic or internal subnets indicate prior unauthorised access.

5. Indicators of compromise

Type	Value	Confidence	Source
Log pattern	SonicWall authentication log session type `sess="CLI"`	High	ReliaQuest (Feb–Mar 2026)
Account indicator	Local SSLVPN account usernames containing non-printable characters	High	SANS ISC audit findings
Session indicator	SSLVPN sessions >24 hours from VPS/hosting provider ASNs	High	SANS ISC audit findings
Session indicator	Sessions on accounts disabled in AD >1 year prior	High	SANS ISC audit findings

log_pattern  sess="CLI"
account_indicator  username_contains_nonprintable_chars
session_indicator  duration_gt_24h_from_vps_hosting_asn
session_indicator  account_disabled_in_ad_gt_1yr

6. Detection

YARA rule

rule SonicWall_SSLVPN_PostPatch_Compromise
{
    meta
        author = "Adverse Trace"
        date = "2026-06-23"
        reference = "https://isc.sans.edu/diary/rss/33094"
        description = "Detects artefacts associated with SonicWall SSLVPN post-patch compromise patterns including CLI session type, Virtual Office Portal abuse, and LDAP userPrincipalName misconfiguration"

    strings:
        $cli_session = "sess=\"CLI\"" ascii wide
        $portal1 = "Virtual Office Portal" ascii wide
        $portal2 = "sslvpn" ascii nocase
        $ldap_upn = "userPrincipalName" ascii wide
        $ldap_default = "Default LDAP User Group" ascii wide
        $sonicos = "SonicOS" ascii wide
        $snwlid = "SNWLID-2024-0015" ascii wide
        $snwlid2 = "SNWLID-2025-0001" ascii wide

    condition:
        3 of them
}

Sigma rule

title: SonicWall SSLVPN CLI Session Type Authentication
id: adverse-trace-2026-06-23-001
status: experimental
description: >
    Detects SonicWall SSLVPN authentication log entries with session type sess="CLI",
    identified as the most consistent early indicator of automated tooling driving
    authentication in observed Akira/Fog intrusions exploiting CVE-2024-40766 and
    CVE-2024-12802.
author: Adverse Trace
date: 2026-06-23
reference: https://isc.sans.edu/diary/rss/33094
logsource:
    product: sonicwall
    service: sslvpn
detection:
    selection_cli:
        event_type: authentication
        session_type: 'sess="CLI"'
    condition: selection_cli
falsepositives:

    - Legitimate administrative CLI sessions (rare; investigate any occurrence)
level: high

Threat actor context

Akira · G1024 · aka GOLD SAHARA, PUNK SPIDER, Howling Scorpius

Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. …

No MITRE ATT&CK profile for: Fog.

7. Sources

SANS Internet Storm Center, "CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration.", 23 June 2026. https://isc.sans.edu/diary/rss/33094

8. Adverse Trace position

Severity: Critical. CVE-2024-40766 carries a CVSS 9.3 score and is under continuous active exploitation by Akira (MITRE G1024) and Fog (attribution unconfirmed — no MITRE profile) ransomware operators. The vulnerability is compounded by CVE-2024-12802 MFA bypass on Gen 6 devices and the September 2025 MySonicWall backup breach exposing all customer configuration backups. Gen 6 hardware reached end-of-life on 16 April 2026 with no further patches forthcoming.

Client impact: EMEA financial services firms running SonicWall SSLVPN — particularly those that applied the CVE-2024-40766 firmware patch without completing post-patch hardening — face an active, well-documented ransomware intrusion path. Dwell times as short as 55 minutes from initial access to encryption have been documented. Stale local accounts, unrotated passwords, overpermissive Default LDAP User Group settings, and exposed Virtual Office Portal endpoints remain common post-patch.

Next steps: Adverse Trace will monitor for additional SonicWall disclosures, track Gen 6 migration guidance, and update this advisory if SonicWall issues further remediation steps or if new exploitation patterns emerge. Clients should prioritise the P1 containment actions within 24 hours and engage managed detection providers to review SonicWall authentication logs for the indicators listed above.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.