Plan ahead Medium Patch available
SonicWall releases fixes for seven flaws, including VPN login bypass
IT Pro (via Google News)SonicWall
What happened. New: SonicWall has released fixes for the SSL-VPN flaw that bypasses multi-factor authentication (MFA), along with six other flaws. The SSL-VPN flaw was covered earlier as exploited and on CISA's known-exploited list.
Who is affected. Users of SonicWall SSL-VPN. Industrial sites using it for remote access are exposed, because vendors and engineers often reach plant systems through it.
What to do. Apply the SonicWall fixes, starting with the SSL-VPN MFA bypass, and check whether you run SonicWall SSL-VPN for remote access.
When to act. Plan ahead: Remote-access teams: patch SonicWall SSL-VPN before the next window; reports are early and details thin.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L3.5
Why: An SSL-VPN gateway is a remote-access gateway at the industrial DMZ (L3.5) and is internet-facing (L5).
- Are you exposed?
Check your asset inventory and firewall list for SonicWall devices with SSL-VPN enabled, and compare their firmware with the vendor advisory.
- If you cannot fix it yet
- Limit who can connect through the SSL-VPN to named users and known source addresses until patched.
- Keep the VPN gateway off the plant network, or restrict what it can reach, until fixed.
- Require MFA on the plant side for remote sessions.
- Watch for
- VPN logons that succeed without the expected MFA step, or from unusual locations.
- New remote sessions from the VPN into L2 or L3 hosts outside normal support hours.
- ATT&CK for ICS
- T0866Exploitation of Remote ServicesT0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: IT Pro (via Google News) (opens news.google.com)
More on SonicWall