CVE-2019-7475 Missing authorization in SonicOS
Unprivileged users can access advanced routing services on SonicWall SonicOS devices with management enabled, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-7475?
CVE-2019-7475 is a critical missing authorization vulnerability in Sonicwall Sonicos, published on 2 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in SonicWall SonicOS and SonicOSv with management enabled system on specific configuration allow unprivileged user to access advanced routing services. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
Weakness: CWE-284
Which versions are affected by CVE-2019-7475?
It affects 2 products.
Products include Sonicwall Sonicos, Sonicwall Sonicosv.
How do I fix CVE-2019-7475?
No fix has been published for CVE-2019-7475 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-7475 being exploited?
There is no known exploitation of CVE-2019-7475 in the wild and no public exploit code.
Other vulnerabilities in Sonicwall Sonicos
Sources
Also known as GHSA-x6wv-vcm5-3f5j.