The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Analytics | Sonicwall | * | 2.5.0.4-r7 (including) |
| Global_management_system | Sonicwall | * | 9.3.2 (excluding) |
| Global_management_system | Sonicwall | 9.3.2 (including) | 9.3.2 (including) |
| Global_management_system | Sonicwall | 9.3.2-sp1 (including) | 9.3.2-sp1 (including) |
References
- http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
- https://www.sonicwall.com/support/notices/230710150218060
- http://packetstormsecurity.com/files/174571/Sonicwall-GMS-9.9.9320-Remote-Code-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
- https://www.sonicwall.com/support/notices/230710150218060