SonicWall Investigates Zero-Day Attack Own Its Products
SonicWall has warned its customers that threat actors may have found zero-day vulnerabilities in some of its remote access products. An initial post on the company’s knowledgebase pages on Friday claimed that the NetExtender VPN client model 10.x and the SMB-focused SMA 100 series were at risk.
However, an update over the weekend clarified that impacted models were confined to its Secure Mobile Access (SMA) version 10.x offering running on SMA 200, SMA 210, SMA 400, SMA 410 physical appliances and the SMA 500v virtual appliance.
These provide client employees with secure remote access to internal resources — capabilities in high demand during the pandemic. As such, there is an apparent advantage to attackers in finding bugs to exploit in such tools.
“We believe it is extraordinarily important to be transparent with our customers, our partners and the broader cybersecurity community about the ongoing attacks on global business and government,” SonicWall said in the alert.
“Recently, SonicWall identified a coordinated attack on its internal systems by highly state-of-the-art threat actors exploiting probable zero-day vulnerabilities on certain SonicWall secure remote access products.”
There is no more information for now on what the attackers were after and how they carried out the intrusion. However, SonicWall also clarified that its firewall products, SonicWave APs and SMA 1000 Series product line are unaffected.
“Current SMA 100 Series customers may continue to use NetExtender for remote access with the SMA 100 series. We have decided that this use case is not susceptible to exploitation,” it added. “We advise SMA 100 collection administrators to create specific access rules or disable Virtual Office and HTTPS administrative get entry to from the internet while we continue to investigate the vulnerability.”
Since the begin of the COVID-19 crisis, security and infrastructure providers have come under increasing scrutiny as attackers look for holes in products which could provide them with large-scale access to customer environments.
Back in April last year, it emerged that sophisticated ransomware groups were exploiting flaws in VPN products to assault hospitals, while in October, the US warned that APT groups were chaining VPN exploits with the Zero logon flaw to target public and private sector organizations.
Products from Fortinet (CVE-2018-13379), MobileIron (CVE-2020-15505), Juniper (CVE-2020-1631), Pulse Secure (CVE-2019-11510), Citrix NetScaler (CVE-2019-19781) and Palo Alto Networks (CVE-2020-2021) were all highlighted as at risk.
