CVE-2023-34132
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
CVE-2023-34132 describes a vulnerability where the use of password hash instead of password for authentication in SonicWall GMS and Analytics allows for Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Risk Assessment
An attacker could gain control over the system by exploiting password hashes, posing a serious security threat to the organization. This could lead to unauthorized access to sensitive data.
Recommendation
It is recommended to upgrade to the latest versions of SonicWall GMS and Analytics to mitigate the risk associated with this vulnerability. Additionally, implementing extra security measures such as multi-factor authentication is advisable.
Original NVD description (English source)
Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.