Cyber Posture

CVE-2024-53704

CriticalCISA KEVActive ExploitationRansomware-linked

Published: 09 January 2025

Published
09 January 2025
Modified
31 October 2025
KEV Added
18 February 2025
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9386 99.9th percentile
Risk Priority 96 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-53704 is a critical-severity Improper Authentication (CWE-287) vulnerability in Sonicwall Sonicos. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-17 (Remote Access) and IA-2 (Identification and Authentication (Organizational Users)).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely identification, reporting, and patching of flaws like the improper authentication vulnerability in SonicWall SSLVPN, as urged by CISA for this actively exploited CVE.

prevent

Mandates secure authorization and authentication mechanisms for remote access portals such as SSLVPN to block unauthenticated remote attackers from bypassing controls.

prevent

Enforces identification and authentication for organizational users accessing systems, directly countering the SSLVPN authentication bypass that grants unauthorized logical access.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Improper authentication bypass on public-facing SSLVPN directly enables remote exploitation of internet-accessible services without credentials.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

Deeper analysisAI

CVE-2024-53704 is an Improper Authentication vulnerability (CWE-287) in the SSLVPN authentication mechanism of SonicWall products. Published on January 9, 2025, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability. A remote attacker can exploit this flaw to bypass authentication entirely.

The attack scenario involves any unauthenticated remote attacker over the network who can send crafted requests to the SSLVPN interface. Successful exploitation grants unauthorized access, potentially allowing the attacker to perform privileged operations within the VPN environment, leading to data exfiltration, modification, or disruption of services as reflected in the high CVSS impact metrics.

SonicWall published advisory SNWLID-2025-0003 detailing the vulnerability at psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-53704 to its Known Exploited Vulnerabilities Catalog at cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53704, indicating active exploitation in the wild and urging federal agencies to apply mitigations promptly.

Security practitioners should prioritize patching affected SonicWall SSLVPN deployments, as real-world exploitation is confirmed via CISA's catalog.

Details

CWE(s)
KEV Date Added
18 February 2025

Affected Products

sonicwall
sonicos
7.1.2-7019, 8.0.0-8035 · 7.1.1-7040 — 7.1.1-7058

CVEs Like This One

CVE-2025-40600Same product: Sonicwall Nsa 2700
CVE-2025-23006Same vendor: Sonicwallboth on KEV
CVE-2025-49706Shared CWE-287both on KEV
CVE-2026-20127Shared CWE-287both on KEV
CVE-2025-61882Shared CWE-287both on KEV
CVE-2026-0204Same product: Sonicwall Nsa 2700
CVE-2025-40602Same vendor: Sonicwallboth on KEV
CVE-2025-61884Shared CWE-287both on KEV
CVE-2026-5570Shared CWE-287
CVE-2025-52395Shared CWE-287

References