CVE-2023-34124
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Risk Assessment
Improper authentication may lead to unauthorized access to systems, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update to the latest versions of GMS and Analytics to mitigate this vulnerability and implement additional security measures.
Other vulnerabilities in SonicWall GMS, SonicWall Analytics
See all- CVE-2023-34137Critical
The SonicWall GMS and Analytics CAS Web Services application uses static values for authentication without proper checks, leading to an authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34136Critical
Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34130Critical
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34127High
CVE-2023-34127 describes an improper neutralization of special elements used in OS commands, allowing an authenticated attacker to execute arbitrary code with root privileges in SonicWall GMS and SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34126High
Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34123High
CVE-2023-34123 involves the use of a hard-coded cryptographic key in SonicWall GMS and SonicWall Analytics. This issue affects GMS versions: 9.3.2-SP1 and earlier; Analytics: 2.5.0.4-R7 and earlier.
Original NVD description (English source)
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.