CVE-2024-12802

CVE Enrichment

CVSS: 9.1 CRITICAL
EPSS: 0.49%
EPSS Percentile: 41.91%
CISA KEV: Not listed

Description

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 09-Jan-2025 16:15
Last Modified: 17-Jun-2026 14:00
EPSS Date: 2026-11-02
CWE: CWE-305

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

References

[email protected]

Last enrichment sync: 03-Nov-2026 06:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

Threat actors brute-forced SonicWall Gen6 SSL-VPN credentials, bypassed MFA via CVE-2024-12802, and used the access to conduct reconnaissance and prepare ransomware-related tooling. SonicWall Gen6 VPN MFA Bypass Exploited When Required Remediation Is Incomplete
ReliaQuest reported the first known in-the-wild exploitation of CVE-2024-12802 against SonicWall SSL VPN appliances, where Gen6 devices remained vulnerable after patching unless six manual reconfiguration steps were ReliaQuest Details SonicWall VPN Exploitation Despite Patching

CVE (1)

Threat Actors (1)

MITRE ATT&CK (8)

Vendors (2)

Products (3)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.