Security Notice: SonicWall Analytics 2.5 On-Prem Remote Command Execution Vulnerability Via Java Debug Wire Protocol
First Published:08/09/2021
Last Updated:08/10/2021
Some versions of SonicWall Analytics On-Prem contain a critical (CVSSv3 9.8) Java Debug Wire Protocol (JWDP) service vulnerability that potentially can be leveraged by a remote, unprivileged user to execute arbitrary code within the system.
SonicWall PSIRT is not aware of active exploitation in the wild.
Impact
The vulnerability allows for unauthenticated remote exploitation. Deployment of SonicWall Analytics 2.5 and earlier are ‘on-prem’ and should be in a secure network segmentation not exposed to the internet.
Temporary Mitigations
Until the below patch can be applied, SonicWall strongly recommends that administrators block access to 9000/TCP port on affected versions.
Resolution
SonicWall PSIRT strongly suggests that organizations using the Analytics On-Prem version outlined below log in to MySonicWall and upgrade to the respective patched version immediately.
| AFFECTED VERSION | PATCHED VERSION | PSIRT ADVISORY ID | APPLICABLE CVEs |
|
|
For guidance on upgrading Analytics on-premises deployments, please reference SonicWall Technical Documentation. Please reach out to SonicWall Technical Support if you require assistance with the upgrade process.
Additional Resources
