Are SonicWall firewalls vulnerable against CVE-2016-6515?

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

SonicOS (firewall) is not vulnerable as it does not use OpenSSH code for authentication.

References used:

• https://nvd.nist.gov/vuln/detail/CVE-2016-6515