SonicWall SonicOS CVE-2024-40766 (improper access control in management and SSLVPN, CISA KEV, used by Akira ransomware): which firewall versions are fixed, and what else do I need to do besides patching?

What it is: CVE-2024-40766 is an improper access control flaw in SonicWall SonicOS management access and SSLVPN, disclosed by SonicWall in August 2024 (advisory SNWLID-2024-0015). It can give unauthorized access to firewall resources and in some conditions crash the firewall. CISA added it to the Known Exploited Vulnerabilities catalog on 2024-09-09, and it has been widely used by ransomware groups, notably Akira, to get in through SSLVPN. Many later incidents hit organizations that had patched or migrated from Gen 6 to Gen 7 but carried over old local user passwords, so the credential steps matter as much as the update. Am I affected: - Gen 5 (SOHO): SonicOS 5.9.2.14-12o and older. - Gen 6/6.5: SonicOS 6.5.4.14-109n and older (Gen 6 NSv virtual firewalls are not affected). - Gen 7: SonicOS 7.0.1-5035 and older. - Check the firmware version on the firewall's System/Device status page, and whether WAN management or SSLVPN is reachable from the internet. Fix: 1. Upgrade per SonicWall's notice: Gen 5 SOHO to 5.9.2.14-13o; Gen 6 to 6.5.4.15-116n or later; Gen 7 to a current release (SonicWall listed 7.0.1-5161, 7.1.1-7058 or 7.1.2-7019 or later). End-of-life units (Gen 5 and older, NSA 2600) won't get further updates: disable WAN management and SSLVPN and replace them. 2. Until patched, restrict firewall management and SSLVPN to trusted source addresses, or turn off internet access to both. 3. Reset passwords for all local SSLVPN accounts (enable 'User must change password' on each local account), especially after a Gen 6 to Gen 7 migration, and enable MFA (TOTP or email OTP) for every SSLVPN user. 4. Remove unused and old local accounts, and review VPN logs for logins from unexpected locations or accounts. If you see signs of misuse, treat the network as compromised: isolate, hunt, and rotate credentials for anything reachable through the VPN. Verify: the firmware matches a fixed build, management and SSLVPN are not open to the whole internet, every local SSLVPN user has a new password and MFA, and the old passwords no longer work. Sources: https://www.sonicwall.com/support/notices/product-notice-improper-access-control-vulnerability-in-sonicos/kA1VN0000000Tq10AE https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2 https://nvd.nist.gov/vuln/detail/CVE-2024-40766 https://www.cisa.gov/news-events/alerts/2024/09/09/cisa-adds-three-known-exploited-vulnerabilities-catalog