Security Notice: SonicWall Analytics 2.5 On-Prem Remote Command Execution Vulnerability Via Java Debug Wire Protocol

Some versions of SonicWall Analytics On-Prem contain a critical (CVSSv3 9.8) Java Debug Wire Protocol (JWDP) service vulnerability that potentially can be leveraged by a remote, unprivileged user to execute arbitrary code within the system.

SonicWall PSIRT is not aware of active exploitation in the wild.



Impact

The vulnerability allows for unauthenticated remote exploitation. Deployment of SonicWall Analytics 2.5 and earlier are ‘on-prem’ and should be in a secure network segmentation not exposed to the internet.

Temporary Mitigations

Until the below patch can be applied, SonicWall strongly recommends that administrators block access to 9000/TCP port on affected versions.

Resolution

SonicWall PSIRT strongly suggests that organizations using the Analytics On-Prem version outlined below log in to MySonicWall and upgrade to the respective patched version immediately.

For guidance on upgrading Analytics on-premises deployments, please reference SonicWall Technical Documentation. Please reach out to SonicWall Technical Support if you require assistance with the upgrade process.

Additional Resources

• SNWLID-2021-0018
• CVE-2021-20032
• Analytics On-Prem Technical Documentation