Hackers bypass SonicWall VPN MFA due to incomplete patching
Update Gen6 SonicWall firmware, delete LDAP config, reboot, and recreate LDAP without userPrincipalName to block MFA bypass.
Apply the latest firmware to Gen6 SonicWall devices, delete the existing LDAP configuration using userPrincipalName, remove cached LDAP users, change User Domain to LocalDomain, reboot, and recreate the LDAP configuration without userPrincipalName.
Summary
SonicWall Gen6 SSL‑VPN appliances suffered a vulnerability (CVE‑2024‑12802) that allowed attackers to bypass MFA by exploiting a missing enforcement for UPN login. The flaw enabled brute‑force credential attacks that took 30‑60 minutes to log in, perform reconnaissance, and deploy a Cobalt Strike beacon. SonicWall warned that installing the firmware update alone does not fully mitigate the issue; a manual LDAP reconfiguration is required. Gen7 and Gen8 firmware updates alone remove the risk. Gen6 devices reached end‑of‑life on April 16 and no longer receive security updates. The required remediation steps include deleting the existing LDAP configuration using userPrincipalName, removing cached LDAP users, changing the User Domain to LocalDomain, rebooting, and recreating the LDAP configuration without userPrincipalName. Attackers used the vulnerability across multiple sectors and geographies, and the incident highlights the need for complete configuration changes after firmware updates.
Key changes
- CVE‑2024‑12802: missing MFA enforcement for UPN login on Gen6 SSL‑VPN
- Firmware update alone insufficient; requires LDAP reconfiguration
- Gen7/8 firmware update alone removes risk
- Attackers brute‑forced credentials, bypassed MFA in 30‑60 minutes, deployed Cobalt Strike beacon
- Gen6 devices reached end‑of‑life on April 16, no longer receive updates
- Required remediation: delete LDAP config, remove cached users, change User Domain, reboot, recreate LDAP without userPrincipalName