Hackers attempt to exploit SonicWall zero-day vulnerability

The flaw is believed to be the same vulnerability used in a security incident confirmed by the company late last month

Cyber security researchers have discovered active exploitation attempts against a zero-day vulnerability in SonicWall’s networking devices.

The flaw is believed to be the same zero-day vulnerability used in a security incident confirmed by the company late last month

Researchers from IT security company NCC Group said that they had notified SonicWall of the flaw as well as the exploits over the weekend. In a Twitter post, the researchers said they had “identified and demonstrated exploitability of a possible candidate for the vulnerability described and sent details to SonicWall”.

“We've also seen indication of indiscriminate use of an exploit in the wild,” the post stated.

NCC Group CTO Ollie Whitehouse said that the company had received confirmation from SonicWall that it had received the security company's warnings about the flaw.

IT Pro contacted the NCC Group for more information. However, according to ZDNet, the researchers have decided not to share details about the nature of the zero-day vulnerability in order to prevent other threat actors from collecting enough information to launch further attacks.

On 23 January, SonicWall announced that it had “identified a coordinated attack on its internal systems by highly sophisticated threat actors exploiting probable zero-day vulnerabilities on certain SonicWall secure remote access products”.

Related Resource

Channel Pro Insight: A fast guide to central network management

How to stay connected and secure with central network management

A fast guide to central network management - whitepaperDownload now

The company didn’t specify when exactly the incident took place but ruled out that its NetExtender VPN Client product had been compromised, adding that the only products to remain under investigation are from the SMA 100 series. However, SonicWall clarified that, despite the investigation, all “SMA 100 series products may be used safely in common deployment use cases”.

On Friday, the company issued an update saying that it’s continuing its investigation into the SMA 100 Series, although “the presence of a potential zero-day vulnerability remains unconfirmed”.

SonicWall also stated that it had analysed a number of reports from its clients of “potentially compromised SMA 100 series devices”, adding that it had “so far only observed the use of previously stolen credentials to log into the SMA devices”.

“We will continue to fully investigate this matter and share more information and guidance as we have it. We will post further updates on this KB and will hopefully soon rule definitively on the outcome of this investigation,” it said.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

How to use machine learning and AI in cyber security
Security

How to use machine learning and AI in cyber security

30 Jul 2021
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

29 Jul 2021
Colonial Pipeline hack spurred copycat attacks on other oil and gas companies
hacking

Colonial Pipeline hack spurred copycat attacks on other oil and gas companies

29 Jul 2021
Study finds companies are mishandling cyber security recruitment
cyber security

Study finds companies are mishandling cyber security recruitment

28 Jul 2021

Most Popular

Salesforce's $28bn Slack acquisition: What's next for workplace collaboration?
collaboration

Salesforce's $28bn Slack acquisition: What's next for workplace collaboration?

22 Jul 2021
UK gun owners urged to be ‘vigilant’ after Guntrader data breach
data breaches

UK gun owners urged to be ‘vigilant’ after Guntrader data breach

23 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021