CVE-2024-53704
Published: 09 January 2025
Summary
CVE-2024-53704 is a critical-severity Improper Authentication (CWE-287) vulnerability in Sonicwall Sonicos. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-17 (Remote Access) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
CVE-2024-53704 is an improper authentication vulnerability, tracked as CWE-287, that affects the SSLVPN authentication mechanism. The flaw carries a CVSS 3.1 score of 9.8 and permits remote, unauthenticated attackers to bypass authentication controls entirely.
A remote attacker can exploit the weakness over the network without credentials or user interaction, resulting in full compromise of confidentiality, integrity, and availability on the affected system. Because the vulnerability resides in the authentication path itself, successful exploitation grants the attacker the same access level that would normally require valid credentials.
The SonicWall PSIRT advisory SNWLID-2025-0003 and CISA’s Known Exploited Vulnerabilities catalog both list the issue, indicating that patches or configuration mitigations are available and that the flaw is under active exploitation in the wild. The associated EPSS score remains elevated at approximately 0.94, reflecting sustained exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52037
Vulnerability details
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
- CWE(s)
- KEV Date Added
- 18 February 2025
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authentication bypass on public-facing SSLVPN directly enables remote exploitation of internet-accessible services without credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and patching of flaws like the improper authentication vulnerability in SonicWall SSLVPN, as urged by CISA for this actively exploited CVE.
Mandates secure authorization and authentication mechanisms for remote access portals such as SSLVPN to block unauthenticated remote attackers from bypassing controls.
Enforces identification and authentication for organizational users accessing systems, directly countering the SSLVPN authentication bypass that grants unauthorized logical access.