CVE-2023-34132
Sonicwall Global Management System ≤ 9.3.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-34132 is a critical-severity Use of Password Hash Instead of Password for Authentication (CWE-836) vulnerability in Sonicwall Global Management System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Pass the Hash (T1550.002); ranked in the top 6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-34132 is a use of password hash instead of password for authentication vulnerability that permits Pass-the-Hash attacks. It affects SonicWall GMS versions 9.3.2-SP1 and earlier as well as Analytics versions 2.5.0.4-R7 and earlier. The flaw carries a CVSS 3.1 score of 9.8 and is tracked under CWE-836.
An unauthenticated attacker can exploit the issue remotely over the network to obtain full control over confidentiality, integrity, and availability of the affected management or analytics platform. Successful Pass-the-Hash abuse allows an adversary to authenticate using captured credential hashes without knowing the underlying passwords.
SonicWall has published vendor advisories SNWLID-2023-0010 and associated support notices that address the vulnerability and direct customers to remediation steps. Public exploit material referencing remote code execution against the affected versions has also appeared on PacketStorm.
The EPSS score stands at 0.7026 with an identical recorded peak, indicating sustained exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-38234
Vulnerability Data
Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper authentication mechanisms require passwords (not pre-hashed values) to be supplied by the claimant and verified server-side.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication credentials, preventing storage or comparison of password hashes as if they were passwords.
Mandates secure authentication mechanisms that preclude the flawed practice of treating password hashes as authenticators.
Requires proper cryptographic practices for protecting passwords, indirectly mitigating misuse of hashes in authentication.
Secure coding guidance can prevent this implementation error but does not address the control's broader intent.