Back to CVE Browser

CVE-2024-40766

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-08-23

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

Affected Platforms (CPE)

💻

Sonicwall

Sonicos

< 5.9.2.14-13o< 6.5.2.8-2n< 6.5.4.15.116n<= 7.0.1-5035

References & Advisories

🔗 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766

Related Security Intelligence Articles

Global Cyber Intel Digest: July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

Global Cyber Intel Digest: July 20, 2026

Technical analysis of zero-day exploit chains against SonicWall SMA1000 appliances (UTA0533), NGINX regular expression heap corruption vulnerabilities (CVE-2026-42533), and Sandworm's (UAC-0145) ClickFix fake CAPTCHA campaigns.

Related Vulnerabilities

CVE-2025-406017.5

A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial...

CVE-2025-406009.8

Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker...

CVE-2025-328187.5

A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker ...

CVE-2024-407659.8

An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause D...