For awareness Medium Patch in your normal cycle
Hong Kong CERT lists multiple flaws in SonicWall SonicOS
Hong Kong Computer Emergency Response Team Coordination Centre (via Google News)SonicWall
What happened. The Hong Kong Computer Emergency Response Team Coordination Centre published an advisory titled "SonicWall SonicOS Multiple Vulnerabilities". The report gives no flaw details, versions or fixes.
Who is affected. Users of SonicWall SonicOS firewalls. Industrial sites using these firewalls or their remote access are exposed, because vendors and engineers often reach plant systems through them.
What to do. Check whether you run SonicWall SonicOS and apply the vendor's patch from the advisory.
When to act. For awareness: no known exploitation and no score stated
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L3.5
Why: SonicOS runs on boundary firewalls that sit between office IT and plant networks, and often carry remote access to industrial systems.
- Are you exposed?
Search your asset inventory for SonicWall firewalls running SonicOS and check whether their management or VPN services face the internet.
- If you cannot fix it yet
- Limit management and VPN access to known administrator addresses.
- Require multi-factor authentication for all remote access through the firewall.
- Keep the firewall's management interface off the internet until patched.
- Watch for
- Unexpected administrator logons or configuration changes on SonicWall firewalls.
- Unusual inbound connections to the firewall's VPN or management services from unknown sources.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
More on SonicWall