CVE-2024-53704: SonicWall SonicOS SSLVPN authentication bypass, actively exploited
The short version: SonicWall's SonicOS SSLVPN has an improper-authentication flaw (CVE-2024-53704) that lets a remote attacker bypass authentication and hijack a session with a crafted cookie. Proof-of-concept exploits are public, it's being exploited in the wild, and it's in CISA's KEV catalog. If you run an affected SonicOS build with SSLVPN exposed, patch or disable SSLVPN now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (SonicWall, CNA) | 8.2 — High · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
| EPSS | 95.13% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-03-11 |
| Known exploited? | Yes — public PoC and active exploitation; CISA notes known ransomware use |
| Vulnerability type | CWE-287 improper authentication → SSLVPN authentication bypass / session hijack |
| Requires authenticated session? | No — pre-authentication |
| Affected | SonicOS 7.1.1-7040 through 7.1.1-7058, 7.1.2-7019, and 8.0.0-8035 (Gen7 firewalls and NSv) |
| Fixed in | The SonicOS 7.1.x and 8.0.0 releases listed in SonicWall SNWLID-2025-0003 |
What you need to know
CVE-2024-53704 is an authentication bypass in the SSLVPN mechanism. By sending a request with a specially malformed session cookie, a remote attacker is handed a valid session — stepping into authenticated access without credentials and without MFA, because MFA is enforced at login and the attacker never goes through login.
Why the practical severity is at the top:
- It's the firewall's remote-access service. SSLVPN portals are meant to be internet-facing, so the vulnerable surface is exposed by design.
- It's a clean pre-auth bypass. No credential, no chain — a crafted cookie is enough to obtain a session.
- It's operational. Public PoCs made exploitation trivial to reproduce, active exploitation followed, and CISA notes known ransomware use.
How serious we see it
High — in practice.
There's a scoring gap worth naming: NVD rates it 9.8, while SonicWall's own CNA score is 8.2 (modeling a lower confidentiality impact). We rate by what it does — an unauthenticated attacker obtains an authenticated SSLVPN session on an internet-facing firewall, it's in KEV, there's a public exploit, and it's tied to ransomware — so we side with the higher, real-world read: Critical. The bounded, reassuring part is that it's specific and fixable: particular SonicOS builds with SSLVPN enabled, a published patch, and a clean interim option (disable SSLVPN).
Recommendations
Straight from SonicWall's advisory (SNWLID-2025-0003) and CISA:
- Patch now. Update affected SonicOS 7.1.x and 8.0.0 firewalls to the fixed releases in the advisory.
- If you can't patch immediately, disable SSLVPN. This closes the exposure until you can update.
- Hunt for prior use. SonicWall documents an SSLVPN event-log signature seen when the PoC is used; review logs for anomalous or reused SSLVPN sessions.
- If you find indicators, respond. Terminate active SSLVPN sessions, rotate credentials, and investigate for lateral movement.
- Confirm your exposure first. Verify whether you run an affected build with SSLVPN reachable from the internet.
How BreachRisk sees it
BreachRisk discovers internet-facing SonicWall SSLVPN portals from little more than your domain, fingerprints the SonicOS product and version, and flags exposure tied to CVE-2024-53704 — raised to the top because it's in KEV and tied to ransomware. Where authorized, it goes a step past a scanner: it sends a safe, bounded check using the malformed cookie and looks only for the tell-tale session response, confirming the bypass without taking any action inside your firewall.
That's the honest difference between "this build looks affected" and "we confirmed the bypass responds" — surfaced continuously, so the exposed firewall is already mapped when a flaw like this breaks.