Actively exploited in the wild
SonicWall SonicOS Buffer Overflow Vulnerability
SonicWall - SonicOS · Listed in the CISA KEV since 2022-03-15. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-5135
CriticalCVSS 9.8KEVSummary
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. It affects SonicOS Gen 6 versions 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
Risk Assessment
A remote attacker can cause firewall unavailability or execute arbitrary code, potentially disrupting network protection and compromising the infrastructure.
Recommendation
Update SonicOS to a version later than those listed (6.5.4.7, 6.5.1.12, 6.0.5.3, 6.5.4.v, 7.0.0.0) per vendor guidance. Restrict access to the firewall management interface from untrusted networks.
Other vulnerabilities in SonicOS
See all- CVE-2026-0204High
A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.
- CVE-2026-0516Medium
SonicOS contains a vulnerability related to improper neutralization of HTTP headers for scripting syntax. A remote attacker can manipulate the Host header and redirect firewall management users to arbitrary web domains.
Original NVD description (English source)
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.