SonicWall VPN Portal Vulnerable to Stack-based Buffer Overflow Vulnerability (CVE-2020-5135)

Researchers at Tripwire’s Vulnerability and Exposure Research Team discovered a critical pre-authentication vulnerability in the VPN portal for SonicWall’s Network Security Appliance.

The vulnerability, identified as CVE-2020-5135, is a stack-based buffer overflow vulnerability. A remote, unauthenticated attacker can trigger the vulnerability by sending a specially crafted HTTP request using a custom protocol handler to a vulnerable device. It was patched by SonicWall along with 11 other vulnerabilities on October 12.

For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.