Security Notice: SonicWall Analytics 2.5 On-Prem Remote Command Execution Vulnerability Via Java Debug Wire Protocol

First Published:08/09/2021 Last Updated:08/10/2021

Some versions of SonicWall Analytics On-Prem contain a critical (CVSSv3 9.8) Java Debug Wire Protocol (JWDP) service vulnerability that potentially can be leveraged by a remote, unprivileged user to execute arbitrary code within the system.

SonicWall PSIRT is not aware of active exploitation in the wild.



Impact

The vulnerability allows for unauthenticated remote exploitation. Deployment of SonicWall Analytics 2.5 and earlier are ‘on-prem’ and should be in a secure network segmentation not exposed to the internet.


Temporary Mitigations

Until the below patch can be applied, SonicWall strongly recommends that administrators block access to 9000/TCP port on affected versions.


Resolution

SonicWall PSIRT strongly suggests that organizations using the Analytics On-Prem version outlined below log in to MySonicWall and upgrade to the respective patched version immediately.



AFFECTED
VERSION
PATCHED
VERSION
PSIRT
ADVISORY ID
APPLICABLE CVEs
  • Analytics On-Prem 2.5.2518 and earlier
  • Analytics On-Prem 2.5.2519 and later


For guidance on upgrading Analytics on-premises deployments, please reference SonicWall Technical Documentation. Please reach out to SonicWall Technical Support if you require assistance with the upgrade process.


Additional Resources

Trace:957d8e7b1ca3887eccd6a78a7ba67e6e-76