SonicWall SonicOS Buffer Overflow Vulnerability (CVE-2020-5135)

What is affected, what to do

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This affects SonicOS Gen 6 versions 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v, and Gen 7 version 7.0.0.0. It is actively exploited in ransomware campaigns since 2022. Immediate patching to the latest versions is critical to mitigate this vulnerability.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• SonicWall SonicOS eq SonicOS 6.5.4.7-79n and earlier..SonicOS 6.5.4.7-79n and earlier
• SonicWall SonicOS eq SonicOS 6.5.1.11-4n and earlier..SonicOS 6.5.1.11-4n and earlier
• SonicWall SonicOS eq SonicOS 6.0.5.3-93o and earlier..SonicOS 6.0.5.3-93o and earlier
• SonicWall SonicOS eq SonicOSv 6.5.4.4-44v-21-794 and earlier..SonicOSv 6.5.4.4-44v-21-794 and earlier
• SonicWall SonicOS eq SonicOS 7.0.0.0-1..SonicOS 7.0.0.0-1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Enumerate every SonicWall appliance and SonicOSv virtual instance and check firmware versions. Affected releases are SonicOS Gen 6 up to 6.5.4.7, 6.5.0.0–6.5.1.11 (and 6.5.1.12), 6.0.5.3, SonicOSv 6.5.4.4 (6.5.4.v) and Gen 7 7.0.0.0. Start with units whose HTTP(S) management or SSL-VPN portal is internet-facing.
   • Patch: A vendor patch is available. Look up the fixed builds per product line in the SonicWall PSIRT advisory. Migrate out-of-support Gen 6 hardware to a supported line.
   • Shrink exposure now: Until patched, disable HTTP/HTTPS management on all WAN interfaces. Restrict the SSL-VPN portal (typically TCP 443 or 4433) to known source ranges, or switch it off temporarily if the business can tolerate it.
   • Compromise check: For every exposed, unpatched unit, look for unexpected reboots or crashes. Review config changes, new local admin accounts and unusual VPN sessions over recent weeks. If anything is off, treat the device as compromised and invoke IR.
   • Rotate credentials: If compromise is suspected, reset admin passwords, local VPN accounts, LDAP/RADIUS bind credentials and pre-shared keys. Enforce MFA on SSL-VPN and management access.
   • Regulatory clock: NIS2-scope and KRITIS operators should check BSI notification deadlines (early warning within 24 h) if successful exploitation is indicated.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Make the management interface reachable only from a dedicated admin VLAN or jump-host zone. Use an upstream ACL or filter to drop all internet traffic to the firewall's management ports.
   • IPS / network filtering: On an upstream IDS/IPS (Suricata/Snort), enable signatures for oversized or malformed HTTP request lines aimed at the SonicWall WAN IP. The flaw sits in HTTP request parsing involving a custom protocol handler. Update IPS feeds and confirm coverage for this CVE.
   • Geo / reputation filtering: Limit SSL-VPN portal access with geo-IP rules and threat-intel blocklists (known scanners, TOR exits). This does not replace the patch, but it cuts opportunistic mass-scanning volume.
   • IAM / least privilege: Scope VPN groups to the networks each group actually needs. Do not allow a default "allow all" from the SSL-VPN zone into the LAN.
   • Configuration hardening: Turn off unused services (HTTP management, SNMP on WAN, Virtual Office). Keep hashed config backups so later tampering can be spotted.
   • Operational resilience: Because the bug also yields DoS, keep an HA pair or out-of-band emergency path available so a crash does not take down perimeter connectivity entirely.
3. 03

   Runbook step 3

   Detection rules

   • Device reboots/crashes: Correlate unexpected restarts or web-service failures from SonicWall syslog or SNMP traps (coldStart/warmStart). SPL example: index=fw sourcetype=sonicwall ("restart" OR "reboot" OR "crash") | stats count by host
   • Network telemetry (Zeek/Suricata): Flag HTTP requests to the firewall WAN IP with a non-standard protocol/method field or an abnormally long request line. In Zeek http.log, look for version not in {1.0, 1.1} or non-standard method values. Sigma shape: dst_ip|cidr: <fw_wan> AND (http.version NOT IN ['1.0','1.1'] OR len(request_line) > 1024).
   • Admin changes: Watch for management logins from non-admin IPs, newly created local users, and edits to access rules, NAT or VPN policies. Reconcile these against change tickets.
   • SSL-VPN anomalies: Watch for off-hours logins, logins from new countries or ASNs, multiple sessions per account, and follow-on internal scanning. In Zeek conn.log, look for high fan-out from the VPN pool to TCP 445/3389/5985.
   • Downstream activity: In EDR/Sysmon (EID 1, 3) on hosts reachable from the VPN pool, hunt for ransomware precursors: AdFind, Rclone, PsExec, vssadmin delete shadows. Review Windows Event ID 4624 (logon type 3/10) sourced from the VPN subnet.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• SonicWall SonicWall SonicOS
• SonicWall SonicWall SonicOSv

Weakness classes (CWE)

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  Base

  The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

  Entry at MITRE CWE-120

References & sources

• psirt.global.sonicwall.comvuln-detail/SNWLID-2020-0010x_refsource_CONFIRM, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5135government-resource, US government resource