CVE-2024-12802

criticalpriority · track · 0EPSS 0.005 · 42 %ileDEEURU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.49% (42nd) EPSS

CVSS 9.1 · critical

Is it mine?

21 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-28

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondaryexploitability 3.9 · impact 5.2

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-305USCWE-305US

affected products (21)

Products and version ranges known to be affected.

SonicWall SSL-VPN Gen6 Firewalls <6.5.5.1-6nall versionscert_bundDE
SonicWall SSL-VPN Gen6 NSv <6.5.4.4-44v-21-2472all versionscert_bundDE
SonicWall SSL-VPN Gen7 Firewalls <7.0.1-5165all versionscert_bundDE
SonicWall SSL-VPN Gen7 Firewalls <7.1.3-7015all versionscert_bundDE
SonicWall SSL-VPN TZ80 <8.0.0-8037all versionscert_bundDE
SonicWall SSL-VPN≤ TZ80 <8.0.0-8037cert_bundDE
SonicWall SSL-VPN≤ Gen6 Firewalls <6.5.5.1-6ncert_bundDE
SonicWall SSL-VPN≤ Gen6 NSv <6.5.4.4-44v-21-2472cert_bundDE
SonicWall SSL-VPN≤ Gen7 Firewalls <7.0.1-5165cert_bundDE
SonicWall SSL-VPN≤ Gen7 Firewalls <7.1.3-7015cert_bundDE
SonicWall SonicOS≤ 6.5.4.15-117n and older versionsenisa_euvdEU
SonicWall SonicOS≤ 7.1.1-7058 and older versionsenisa_euvdEU
SonicWall SonicOS≤ 6.5.4.4-44v-21-2457 and older versionsenisa_euvdEU
SonicWall SonicOS≤ 8.0.0-8035enisa_euvdEU
SonicWall SonicOS≤ 7.0.1-5161 and older versionsenisa_euvdEU
SonicWall SonicOS≤ 7.1.2-7019enisa_euvdEU
SonicWall SonicOS≤ 6.5.4.4-44v-21-2472fstec_bduRU
SonicWall SonicOS≤ 7.1.3-7015fstec_bduRU
SonicWall SonicOS≤ 7.0.1-5165fstec_bduRU
SonicWall SonicOS≤ 8.0.0-8037fstec_bduRU

showing 20 of 21

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0021SonicWall SSL-VPN: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-01-07csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in SonicWall SSL-VPN ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2025-01-09modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan