CVE-2024-12802

State: Published
Severity: 9.1 Critical
Published: Jan 9, 2025
Updated: May 22, 2026
Reserved: Dec 19, 2024

Description

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-305 Authentication Bypass by Primary Weakness

Affected Products

Product	Versions
SonicOSSonicWall	6.5.4.4-44v-21-2457 and older versionsAffected 6.5.4.15-117n and older versionsAffected 7.0.1-5161 and older versionsAffected 7.1.1-7058 and older versionsAffected 7.1.2-7019Affected 8.0.0-8035Affected

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0001vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.