CVE-2024-12802 – Critical MFA Bypass in SonicWall Gen6 SSL‑VPN
Key takeaways
- CVE-2024-12802 scores CVSS 9.1 (Critical) and enables attackers to bypass multi‑factor authentication on SonicWall Gen6 SSL‑VPN appliances.
- The vendor‑supplied firmware patch does not fully remediate the flaw; six manual LDAP re‑configuration steps are required.
- Active exploitation has been confirmed in the wild, with brute‑force credential attacks succeeding in as few as 13 attempts and lateral movement occurring within 30 minutes.
- Immediate actions: apply the firmware patch, complete the LDAP re‑configuration, tighten authentication monitoring, and plan migration off end‑of‑life Gen6 devices.
Overview
The newly disclosed CVE-2024-12802 affects SonicWall Gen6 SSL‑VPN appliances. It allows threat actors to bypass multi‑factor authentication (MFA) by exploiting a flaw in the device’s LDAP/Active Directory integration. The vulnerability carries a CVSS 9.1 rating, placing it in the Critical severity band. Since early May 2026, multiple threat‑intel teams have reported active exploitation, with attackers brute‑forcing VPN credentials and moving laterally within minutes.
Technical Details
SonicWall Gen6 devices support LDAP authentication against Active Directory. The firmware incorrectly treats the User Principal Name (UPN) and SAM account name as separate authentication paths. When a user logs in, the device first attempts a SAM bind; if that fails, it falls back to a UPN bind. The fallback path does not enforce the MFA challenge, effectively allowing an attacker who supplies a valid UPN (or a crafted username) to bypass MFA entirely.
Key observations from field reports:
- Attackers can brute‑force VPN credentials with as few as 13 attempts before obtaining a valid login.
- Successful MFA bypass still logs a “MFA success” event, making detection based solely on MFA logs unreliable.
- Logs often contain the attribute
sess='CLI', indicating scripted or automated login attempts. - After initial access, adversaries have been seen reaching file servers within 30 minutes, deploying Cobalt Strike beacons and leveraging shared local admin passwords for lateral movement.
Severity & Impact
| Metric | Value |
|---|---|
| CVSS | 9.1 |
| Severity | Critical |
| Exploited | Active exploitation |
The high CVSS score reflects the ease of bypassing MFA, the low effort required for credential guessing, and the rapid post‑compromise impact on confidentiality and integrity of corporate data.
Affected Products
The flaw is present in Gen6 SonicWall SSL‑VPN appliances, including the SMA 200, SMA 210, and related models that rely on LDAP/AD authentication. SonicWall announced end‑of‑life for Gen6 devices in April 2026, meaning no further security updates will be issued.
For the full list of affected models and firmware versions, see the official CVE page: https://vulnsocial.com/cve/CVE-2024-12802.
Actionable Insights
- Patch verification – Confirm every Gen6 appliance runs the latest firmware that includes the vendor fix for CVE-2024-12802.
- LDAP hardening – Review the LDAP configuration and ensure the six manual remediation steps (bind DN update, disable SAM fallback, enable proper UPN handling, adjust search filters, enforce TLS/SSL, validate directory sync) are applied.
- Log monitoring – Set SIEM alerts for:
- Multiple failed login attempts from the same source IP.
sess='CLI'entries in VPN authentication logs.- Successful MFA events originating from unexpected geolocations or from known VPN/VPS provider IP ranges.
- Event IDs 238 and 1080 indicating authentication anomalies.
- Rate limiting – Enforce account lockout after 5‑10 failed attempts and implement IP‑based throttling on the VPN portal.
- Network segmentation – Isolate VPN‑derived traffic from critical internal systems and enforce least‑privilege access for VPN‑authenticated accounts.
- Asset inventory – Identify all Gen6 devices still in production and prioritize their upgrade or replacement.
Remediation & Mitigation
- Apply the vendor firmware patch – Download the latest update from SonicWall and install it on every Gen6 appliance.
- Complete the six manual LDAP re‑configuration steps – Update the LDAP bind DN, disable SAM fallback, enable proper UPN handling, adjust search filters, enforce TLS/SSL, and validate directory synchronization.
- Validate MFA enforcement – Conduct test logins to confirm the MFA prompt cannot be bypassed after re‑configuration.
- Hardening controls – Enable account lockout after 5 failed attempts, enforce strong password policies, and consider adding certificate‑based client authentication as an additional factor.
- Detect & respond – Deploy SIEM rules to flag the log patterns described above and integrate threat‑intel feeds that identify IPs associated with known exploitation campaigns.
- Plan migration – Schedule replacement of Gen6 appliances with a supported SonicWall generation (Gen7 or later) or an alternative VPN solution before the end‑of‑life date.
Bottom Line
CVE-2024-12802 is a Critical vulnerability that enables MFA bypass on SonicWall Gen6 SSL‑VPN devices. The vendor’s firmware patch alone is insufficient; administrators must complete the manual LDAP re‑configuration and adopt robust detection and hardening measures. Organizations still operating Gen6 appliances should treat this as a top priority for immediate remediation and long‑term migration.
References
#CVE202412802 #SonicWall #MFABypass #Critical #VPN #ActiveExploitation #ReliaQuest