Analysis Summary

SonicWall has issued an urgent security advisory in response to a sharp rise in cyberattacks targeting its Gen 7 firewalls, specifically those with the SSLVPN (Secure Sockets Layer Virtual Private Network) feature enabled. Over the past 72 hours, the company has observed a notable increase in threat activity, both internally and from external sources. While the exact nature of the attacks is still being investigated, a key concern is whether the attacks are exploiting an existing vulnerability or if a previously unknown zero-day flaw is being used by threat actors.

The alert has garnered attention from major cybersecurity research teams, all of whom have observed similar malicious campaigns and are working closely with SonicWall to investigate the root cause. SonicWall emphasized that it is collaborating with external partners to determine if these incidents are connected to past vulnerabilities or indicate a new exploit. The company has promised to provide continuous updates and release updated firmware along with mitigation instructions if a new vulnerability is confirmed.

As an immediate precaution, SonicWall strongly advises customers to disable the SSLVPN feature on Gen 7 firewalls if possible. For organizations that rely on SSLVPN for remote access and cannot disable it, SonicWall has outlined several essential mitigation steps: limit SSLVPN access to trusted IP addresses, enable security services such as Botnet Protection and Geo-IP Filtering, enforce multi-factor authentication (MFA), audit all user accounts to remove unused or inactive ones, and implement strong password policies across all user accounts. While MFA remains a crucial layer of security, SonicWall warned that it may not be sufficient to fully protect against the current threat vector.

Overall, SonicWall is urging all customers to take these recommendations seriously and implement them without delay. The company’s proactive stance, along with cooperation from leading security firms, reflects the severity of the attacks and the urgency to mitigate risks. Users are encouraged to stay alert for updates and be ready to apply new security patches or configuration changes as more information becomes available.

Impact

• Security Bypass
• Unauthorized Access
• Reputation Damage

Affected Vendors

Remediation

• Disable the SSLVPN feature on Gen 7 firewalls wherever practical.
• Limit SSLVPN connectivity to known and trusted source IP addresses.
• Activate security features such as Botnet Protection and Geo-IP Filtering to help block malicious actors.
• Enable multi-factor authentication (MFA) for all remote access users, but note that MFA alone may not fully prevent the current threats.
• Remove inactive or unused local user accounts, especially those with SSLVPN access.
• Enforce strong password policies and encourage regular password updates for all accounts.
• Monitor for further updates from SonicWall, including new firmware and mitigation instructions.
• Stay alert and monitor systems closely for any suspicious or unauthorized activity.