SonicOS CVE-2024-53704: SSLVPN Session Hijack Bypass

What to do

1. Record the SonicOS build on every Gen7 and TZ80 firewall from the management dashboard or the CLI (show version).
2. Upgrade anything on 7.1.1-7058 or older 7.1.x, 7.1.2-7019 or 8.0.0-8035 to the current release for that platform.
3. Until patched, limit SSLVPN to trusted source addresses or disable SSLVPN access from the internet, as SonicWall advises.
4. Search SSLVPN event logs for the 'Reuse SSLVPN session' message that SonicWall published as an indicator.
5. If you find signs of hijacking, treat it as a network intrusion: reset the affected users' passwords and MFA, and review what their VPN sessions reached.

How to check if you are affected or compromised

• Search firewall event logs for SSL VPN Session events reading 'User <name>: Reuse SSLVPN session for the <n> time(s)', which SonicWall lists as an indicator of the public PoC.
• Correlate SSLVPN session IDs with source IPs; one session used from several unrelated addresses suggests hijacking, per Bishop Fox.
• Check for unexpected NetExtender tunnels or internal access from VPS hosting ranges after February 10, 2025.

What happened#

On January 7, 2025, SonicWall published SNWLID-2025-0003, which covers four SonicOS bugs. The serious one is CVE-2024-53704, an improper authentication flaw (CWE-287) in the SSLVPN authentication mechanism that "allows a remote attacker to bypass authentication." Daan Keuper, Thijs Alkemade and Khaled Nassar of Computest Security reported it through Trend Micro's Zero Day Initiative, according to the CVE record. SonicWall scored it 8.2. NVD scores it 9.8.

On February 10, 2025, Bishop Fox published the details and a working exploit. The session-cookie check mishandles Base64-encoded cookies. Sending 32 null bytes, Base64-encoded, as the swap cookie skips validation and hands the attacker an active SSL VPN session. The attacker then sees the user's Virtual Office bookmarks, username and domain, can download a NetExtender profile, can open a VPN tunnel into whatever that user can reach, and can log the user out. MFA does not help, because the attacker takes over a session that already passed it. Bishop Fox counted about 4,500 unpatched internet-facing SSL VPN servers as of February 7.

Arctic Wolf saw exploitation attempts soon after the exploit appeared. The Register reported that they began on February 12, came from fewer than ten sources on VPS hosting, and were mixed with scanning for other bugs. CISA added the CVE to KEV on February 18, 2025, and now marks it as known to be used in ransomware campaigns. We found no public report naming the ransomware group as of October 23, 2026.

Who is affected#

Gen7 hardware firewalls (TZ, NSa and NSsp models) and Gen7 NSv on 7.1.1-7058 or older 7.1.x builds, or 7.1.2-7019, plus TZ80 on 8.0.0-8035. Fixes are 7.1.3-7015 and later, and 8.0.0-8037 and later. SonicWall says SMA100 and SMA1000 appliances are not affected. The same advisory fixes CVE-2024-40762 (a weak random number generator in SSLVPN tokens), CVE-2024-53705 (SSRF in SSH management) and CVE-2024-53706 (privilege escalation on cloud NSv), some of which also reach Gen6 and 7.0.x.

Do you really need to act?#

Most SonicWall shops patched in early 2025, so the job now is to check. It matters for two reasons. First, the attack needs no credentials, and session hijacking defeats MFA. Any firewall still on an affected build with SSLVPN open is easy to break into. Second, SonicWall SSLVPN has been a favorite ransomware entry point. That includes CVE-2024-40766, the access-control bug behind the Akira campaigns. A firewall that missed this patch probably missed others too. Confirm the build, then check the logs once.

What to do now#

1. Record the SonicOS build on every Gen7 and TZ80 unit from the dashboard or with show version in the CLI.
2. Upgrade anything on 7.1.1-7058 or older 7.1.x, 7.1.2-7019 or 8.0.0-8035 to the current release for that platform.
3. Until then, limit SSLVPN to trusted sources or disable it from the internet.
4. Search the SSLVPN logs as described below.
5. If you find hijacking, reset affected users' passwords and MFA and review what their sessions reached.

How to tell if you were hit#

SonicWall's advisory lists one indicator for the public exploit. It is an "SSL VPN Session" event with the message User [name]: Reuse SSLVPN session for the [n] time(s). Bishop Fox warns that failed attempts are dropped silently and successful ones leave little trace. It suggests correlating logs so that one SSLVPN session used from several source IPs stands out. Treat VPN sessions or NetExtender tunnels from VPS hosting ranges after February 10, 2025 as suspect.

Timeline#

• Nov 5, 2024 — Computest reports the flaw.
• Jan 7, 2025 — SonicWall publishes SNWLID-2025-0003 and fixed firmware.
• Feb 10, 2025 — Bishop Fox publishes exploit details; SonicWall adds the log indicator.
• Feb 12, 2025 — Arctic Wolf sees the first exploitation attempts.
• Feb 18, 2025 — CISA adds CVE-2024-53704 to KEV, with a March 11 deadline.

Vulnerability records

• CVE-2024-53704 · KEV 2025-02-18 · An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. SonicWall PSIRT — SNWLID-2025-0003: SonicOS Affected By Multiple Vulnerabilities psirt.global.sonicwall.com
2. CVE record — CVE-2024-53704 cve.org
3. NVD — CVE-2024-53704 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2024-53704 cisa.gov
5. Bishop Fox — SonicWall CVE-2024-53704: SSL VPN Session Hijacking bishopfox.com
6. Arctic Wolf — CVE-2024-53704: SonicWall SonicOS SSLVPN Authentication Bypass arcticwolf.com

Coverage and analysis

1. The Register — SonicWall firewalls under attack: patch now theregister.com