---
title: "SonicWall CVE-2024-40766: SSLVPN Flaw Behind Akira Attacks"
url: https://erroneo.us/security/briefs/sonicwall-sonicos-sslvpn-cve-2024-40766-akira/
description: "SonicOS access-control bug used by Akira and Fog. Fixed in 2024, but migrated Gen 6 passwords kept it alive in 2025. Check firmware and reset local passwords."
type: security-brief
section: "Security Digest"
date_published: 2024-08-22
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-40766"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SonicWall CVE-2024-40766: SSLVPN Flaw Behind Akira Attacks

**Verdict: Check exposure.** Patched firmware is not the whole fix: if you migrated a Gen 6 config to Gen 7, or ever ran vulnerable firmware with SSLVPN exposed, reset every local SSLVPN password today.

- **Who must act:** SonicWall firewall owners with SSLVPN or management reachable from the internet who never reset local passwords after patching or a Gen 6 to Gen 7 migration, and anyone still running end-of-life Gen 5 or Gen 6 units.
- **Who can relax:** Gen 7 firewalls on SonicOS 7.3.0 or later whose local accounts were reset after patching, with MFA enforced and the Virtual Office Portal and management limited to trusted networks.
- **Affected:** Gen 5 SOHO: SonicOS 5.9.2.14-12o and older; Gen 6 firewalls: SonicOS 6.5.4.14-109n and older; Gen 7 firewalls: SonicOS 7.0.1-5035 and older; NSA 2600, Gen 5 (excluding SOHO) and older end-of-life units: no fix
- **Fixed:** Gen 5 SOHO: 5.9.2.14-13o and higher; Gen 6: 6.5.4.15.116n and higher (6.5.2.8-2n for SM 9800, NSsp 12400, NSsp 12800); Gen 7: builds above 7.0.1-5035; SonicWall's 2025 guidance is 7.3.0 or later
- **CVEs:** CVE-2024-40766
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the SonicOS version on every firewall and upgrade Gen 7 to 7.3.0 or later and Gen 6 to at least 6.5.4.15.116n.
2. Force a password reset for every local SSLVPN account, especially accounts migrated from Gen 6, and rotate the LDAP bind credential.
3. Delete unused local accounts and require MFA, account lockout and Botnet Filtering for SSLVPN.
4. Point the LDAP SSLVPN default user group at a group with no access, and limit the Virtual Office Portal and management to trusted networks.
5. Replace end-of-life Gen 5 and Gen 6 units, or turn off SSLVPN and WAN management on them.

### How to check if you are affected

- Review SSLVPN login events for logins from hosting or VPS providers instead of broadband ISPs, sessions over 24 hours, and accounts with no matching employee.
- Check logs for the IoC addresses in SNWLID-2024-0015, such as 88.119.175.104, 45.149.172.51 and 172.86.116.8.
- Look for TOTP enrollments nobody requested through the Virtual Office Portal.
- On internal hosts, hunt for new accounts like backupSQL or lockadmin, cloudflared.exe or OpenSSH in C:\ProgramData, and vssadmin shadow-copy deletion.

## What happened

On August 22, 2024, SonicWall published [SNWLID-2024-0015](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015) for CVE-2024-40766, an improper access control flaw in SonicOS management access that can grant unauthorized access or crash the firewall. On September 6 it added SSLVPN and warned of exploitation. CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766) on September 9 and flags ransomware use. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-40766) scores it 9.8.

[Arctic Wolf](https://arcticwolf.com/resources/blog/arctic-wolf-observes-akira-ransomware-campaign-targeting-sonicwall-sslvpn-accounts/) found Akira affiliates logging in through local SSLVPN accounts without MFA on vulnerable firmware. By October 2024 it counted at least 30 such intrusions, about 75% Akira and the rest Fog, [BleepingComputer](https://www.bleepingcomputer.com/news/security/fog-ransomware-targets-sonicwall-vpns-to-breach-corporate-networks/) reported.

A second Akira wave began around July 22, 2025, seen by [Arctic Wolf](https://arcticwolf.com/resources/blog/arctic-wolf-observes-july-2025-uptick-in-akira-ransomware-activity-targeting-sonicwall-ssl-vpn/) and [Huntress](https://www.huntress.com/blog/exploitation-of-sonicwall-vpn). SonicWall's [August 2025 notice](https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2) said it was "not connected to a zero-day vulnerability" but correlated with CVE-2024-40766, with fewer than 40 incidents. Many involved Gen 6 to Gen 7 migrations whose local passwords were carried over and never reset. [Rapid7](https://www.rapid7.com/blog/post/dr-akira-ransomware-group-utilizing-sonicwall-devices-for-initial-access/) added two configuration risks: an LDAP SSLVPN default group that over-grants access, and a public Virtual Office Portal where a stolen password lets an attacker enroll their own TOTP device.

## Who is affected

Gen 5 SOHO on 5.9.2.14-12o or older (fixed in 5.9.2.14-13o), Gen 6 on 6.5.4.14-109n or older (fixed in 6.5.4.15.116n, or 6.5.2.8-2n for SM 9800 and NSsp 12400/12800), and Gen 7 on 7.0.1-5035 or older. SonicWall now recommends SonicOS 7.3.0, which adds brute-force protection. End-of-life Gen 5 units get no fix, and many Gen 6 models are out of support: TZ 400, TZ 600 and NSa 3600/3650 reached end of support on August 1, 2026, per [SonicWall](https://www.sonicwall.com/support/product-notification/sonicwall-last-order-day-of-support-announcement-tz-400-tz400w-tz600-tz-600p-nsa-3600-nsa-3650/kA1VN0000000R1u0AE).

## Do you really need to act?

Patching did not invalidate stolen credentials. A Gen 6 configuration imported into Gen 7 brings its local passwords along, so a password taken from a vulnerable Gen 6 box still works on a patched Gen 7 box. A June 2026 [SANS ISC](https://isc.sans.edu/diary/33094) audit of 14 patched firewalls found 11 had not rotated passwords and 9 mapped the LDAP default group to SSLVPN access; attackers, it says, "are scanning for patched firewalls where nobody completed the post-patch steps."

The verdict is check-exposure with one urgent group: if you migrated Gen 6 to Gen 7, or ran vulnerable firmware with SSLVPN exposed, and never reset local passwords, do it today. With current firmware, reset passwords and MFA, you are done.

## What to do now

1. Check firmware with `show version` in the SonicOS CLI. Move Gen 7 to 7.3.0 or later and Gen 6 to at least 6.5.4.15.116n.
2. Enable "User must change password" on every local SSLVPN account, or use SonicWall's bulk-change script. Rotate the LDAP bind password.
3. Delete unused local accounts; enable MFA, account lockout and Botnet Filtering.
4. Point the LDAP SSLVPN default group at a group with no access, limit the Virtual Office Portal and management to trusted networks, and confirm from outside with `nmap -Pn -p 443,4433 <wan-ip>`.
5. Replace end-of-life units, or disable SSLVPN and WAN management on them.

## How to tell if you were hit

Review SSLVPN login events. Arctic Wolf's main tell is logins from hosting or VPS providers instead of broadband ISPs; SANS adds sessions over 24 hours and accounts with no matching employee. Check for the advisory's IoC addresses, such as `88.119.175.104` and `45.149.172.51`, and for TOTP enrollments nobody requested. Huntress saw Akira create accounts like `backupSQL` and `lockadmin`, stage `cloudflared.exe` and OpenSSH in `C:\ProgramData`, and run `vssadmin delete shadows /all /quiet`. Encryption can follow within hours, so any match means incident response.

## Timeline

- Aug 22, 2024 — SonicWall publishes SNWLID-2024-0015.
- Sep 9, 2024 — CISA adds the CVE to KEV.
- Jul 22, 2025 — Akira's second wave begins, Arctic Wolf says.
- Aug 4, 2025 — SonicWall's notice; by August 6 it blames this CVE and unreset passwords.
- Nov 13, 2025 — CISA and the FBI's [updated Akira advisory](https://www.ic3.gov/CSA/2025/251113.pdf) names this CVE as an entry route.
- Jun 23, 2026 — SANS ISC finds patched firewalls still misconfigured.

## Sources

1. [SonicWall PSIRT — SNWLID-2024-0015: SonicOS Improper Access Control Vulnerability](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015)
2. [SonicWall — Gen 7 and Newer SonicWall Firewalls: SSLVPN Recent Threat Activity](https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2)
3. [SonicWall — Last Order Day of Support Announcement: TZ 400, TZ 400W, TZ 600, TZ 600P, NSA 3600, NSa 3650](https://www.sonicwall.com/support/product-notification/sonicwall-last-order-day-of-support-announcement-tz-400-tz400w-tz600-tz-600p-nsa-3600-nsa-3650/kA1VN0000000R1u0AE)
4. [CVE record — CVE-2024-40766](https://www.cve.org/CVERecord?id=CVE-2024-40766)
5. [NVD — CVE-2024-40766](https://nvd.nist.gov/vuln/detail/CVE-2024-40766)
6. [CISA — Known Exploited Vulnerabilities: CVE-2024-40766](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766)
7. [Arctic Wolf — Arctic Wolf Observes Akira Ransomware Campaign Targeting SonicWall SSLVPN Accounts](https://arcticwolf.com/resources/blog/arctic-wolf-observes-akira-ransomware-campaign-targeting-sonicwall-sslvpn-accounts/)
8. [Arctic Wolf — Arctic Wolf Observes July 2025 Uptick in Akira Ransomware Activity Targeting SonicWall SSL VPN](https://arcticwolf.com/resources/blog/arctic-wolf-observes-july-2025-uptick-in-akira-ransomware-activity-targeting-sonicwall-ssl-vpn/)
9. [Huntress — Active Exploitation of SonicWall VPNs](https://www.huntress.com/blog/exploitation-of-sonicwall-vpn)
10. [Rapid7 — Akira Ransomware Group Utilizing SonicWall Devices for Initial Access](https://www.rapid7.com/blog/post/dr-akira-ransomware-group-utilizing-sonicwall-devices-for-initial-access/)
11. [CISA, FBI et al. — #StopRansomware: Akira Ransomware (AA24-109A, updated Nov 13, 2025)](https://www.ic3.gov/CSA/2025/251113.pdf)
12. [SANS ISC — CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration.](https://isc.sans.edu/diary/33094)
13. [BleepingComputer — Fog ransomware targets SonicWall VPNs to breach corporate networks](https://www.bleepingcomputer.com/news/security/fog-ransomware-targets-sonicwall-vpns-to-breach-corporate-networks/)

---
Source page: https://erroneo.us/security/briefs/sonicwall-sonicos-sslvpn-cve-2024-40766-akira/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt