SonicWall Gen6 VPN MFA Bypass Exploited When Required Remediation Is Incomplete
Summary
ReliaQuest reported intrusions exploiting CVE-2024-12802 to bypass MFA on SonicWall Gen6 SSL-VPN appliances. Firmware alone does not fix the issue: administrators must also reconfigure LDAP. EDR blocked attempted Cobalt Strike and driver deployment.
Key points
- Attackers brute-forced SonicWall Gen6 SSL-VPN credentials and bypassed MFA using CVE-2024-12802, which fails to enforce MFA for a UPN login format.
- ReliaQuest assessed with medium confidence that the activity was the first in-the-wild exploitation of the vulnerability; it investigated intrusions from February to March.
- Researchers said access sessions commonly lasted 30–60 minutes and included network reconnaissance and credential-reuse testing.
- In one investigated intrusion, the attacker reached a domain-joined file server and connected over RDP using a shared local administrator password.
- The attacker attempted to deploy a Cobalt Strike beacon and a vulnerable driver, but the environment’s EDR blocked both.
- SonicWall Gen6 devices require manual LDAP reconfiguration after a firmware update; Gen7 and Gen8 devices are fully remediated by updating firmware, according to the article.
- ReliaQuest recommends checking for sess="CLI", event IDs 238 and 1080, and VPN logins from suspicious VPS/VPN infrastructure.
Article Details
- Vulnerability Types
- Multi-factor authentication (MFA) bypass
- Authentication bypass
- Affected Versions
- SonicWall Gen6 SSL-VPN appliances
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- On Gen6 devices, install the latest firmware, remove the existing LDAP configuration using userPrincipalName, remove cached or listed LDAP users, remove the SSL VPN User Domain, reboot, and recreate the LDAP configuration without userPrincipalName.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolAn attacker established a remote connection to an internal file server over RDP.T1078 · Valid AccountsAfter gaining access, an attacker used a shared local administrator password to connect to a domain-joined file server.T1110.001 · Password GuessingThe intruders brute-forced credentials for SonicWall Gen6 SSL-VPN appliances.T1133 · External Remote ServicesThe attackers gained initial access through SonicWall SSL-VPN appliances.T1190 · Exploit Public-Facing ApplicationThe intruders exploited CVE-2024-12802 against SonicWall Gen6 SSL-VPN appliances to bypass MFA and gain access.T1562.001 · Disable or Modify ToolsThe attacker attempted to use a vulnerable driver, likely through BYOVD, to disable endpoint protection; the EDR solution blocked the driver.