CVE-2024-12802

Description

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.

Reserved 2024-12-19 | Published 2025-01-09 | Updated 2025-01-09 | Assigner sonicwall

Problem types

CWE-305 Authentication Bypass by Primary Weakness

Product status

Default status
unknown

6.5.4.4-44v-21-2457 and older versions
affected

6.5.4.15-117n and older versions
affected

7.0.1-5161 and older versions
affected

7.1.1-7058 and older versions
affected

7.1.2-7019
affected

8.0.0-8035
affected

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0001 vendor-advisory

cve.org (CVE-2024-12802)

nvd.nist.gov (CVE-2024-12802)

Download JSON