IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
9.8Crítica KEV Usada en ransomware

CVE-2020-5135SonicWall SonicOS Buffer Overflow Vulnerability

SonicWall SonicOS Publicada: (hace 6 años)

Explotación conocida — SonicWall SonicOS Buffer Overflow Vulnerability

CISA confirmó el 15.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 05.04.2022.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-5135

Descripción

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.

Debilidad (CWE): CWE-120

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
SonicWall SonicOS SonicOS 6.5.4.7-79n and earlier, SonicOS 6.5.1.11-4n and earlier, SonicOS 6.0.5.3-93o and earlier, SonicOSv 6.5.4.4-44v-21-794 and earlier, SonicOS 7.0.0.0-1
sonicwall sonicosv ≤ 6.5.4.4

Referencias y parches

Coincidencias CPE (NVD) (5)
  • cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* ≤ 6.0.5.3
  • cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* ≥ 6.5.0.0 ≤ 6.5.1.11
  • cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* ≥ 6.5.4.0 ≤ 6.5.4.7
  • cpe:2.3:o:sonicwall:sonicos:7.0.0.0:*:*:*:*:*:*:*
  • cpe:2.3:o:sonicwall:sonicosv:*:*:*:*:*:*:*:* ≤ 6.5.4.4

CVE recientes del mismo producto — SonicWall

7.2Alta
CVE-2026-100232
SonicWall Network Security Manager (NSM)

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a re…

1.2%EPSS
8.8Alta
CVE-2026-96540
SonicWall Network Security Manager (NSM)

An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escal…

6.1Media
CVE-2026-102258
SonicWall SMA1000

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and poten…

7.2Alta
CVE-2026-102257
SonicWall SMA1000

A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.

7.8Alta
CVE-2026-102256
SonicWall SMA1000

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as …

10.0Crítica
CVE-2026-102255
SonicWall SMA1000

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the applian…