Attackers could disrupt an organization’s business processes
Positive Technologies released more details about a vulnerability its researcher, Nikita Abramov discovered that allows authenticated attackers to obtain full control of on-premises SonicWall Network Security Manager (NSM). NSM is designed to centralize management of SonicWall firewalls and track threats and risks in network traffic. According to IDC, SonicWall ranks fifth among manufacturers of hardware security tools worldwide.
Recommended ITech News: Demand for Cloud Data Migration Fuels Flexify.IO Expansion to 20 Supported Public Clouds and Cloud Storage Environments
This vulnerability, known as CVE-2021-20026, is rated as ‘High’ criticality and has a CVSSv3 score of 8.8. An attacker needs to be an authenticated user into SonicWall NSM before they can exploit the vulnerability, which could allow criminals to inject OS commands in a user request, giving them access to all features of not only the vulnerable on-premises SonicWall NSM platform, but also the underlying operating system. This vulnerability was patched by SonicWall in May 2021.
Nikita Abramov, Positive Technologies researcher explained: “A successful attack on a vulnerable device requires authorization in NSM with a minimum level of privileges. SonicWall NSM allows centralized management of hundreds of devices. Tampering with this system may negatively impact a company’s ability to work, to the point of full disruption of its protection system and stopping of business processes. As with Cisco ASA, successful attackers could disable access to the company’s internal network by blocking VPN connections, or write new network traffic policies thus fully preventing its checks by a firewall.”
Recommended ITech News: Default Cloud Security TDefault Cloud Security Tools May Not Protect Data Enoughools May Not Protect Data Enough
SonicWall PSIRT added: “Through ongoing collaboration with Positive Technologies, SonicWall validated and patched a post-authentication vulnerability within the on-premises version of the Network Security Manager (NSM) service. This vulnerability only impacts on-premises deployments and not the more common SaaS version of the NSM service. Impacted SonicWall partners and customers were quickly informed of the patch and were provided upgrade guidance in May 2021.”
From a technical standpoint, this vulnerability is caused by insufficient filtering of input data and its direct transfer to an operating system for processing. Such errors can be reduced or removed entirely by ensuring secure coding practices are adopted, reducing the propensity of coding weaknesses making it through the development lifecycle. However, as code weaknesses can and do happen to find their way past automated code checks, enabling penetration tests of the devices before they’re launched into production can offer increased assurance that certain weaknesses and vulnerabilities are caught and removed.
Recommended ITech News: ModelOps Announces New Actionable Monitoring that Results in Increased Model Revenue Contribution
