SonicOS firewalls
CVE-2024-12802: SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (Us…
SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| SonicOS (Gen6 NSv, Gen6 Hardware, Gen7 Hardware, Gen7 NSv, TZ80) 6.5 | See the advisory |
| SonicOS (Gen6 NSv, Gen6 Hardware, Gen7 Hardware, Gen7 NSv, TZ80) 7.0 | See the advisory |
| SonicOS (Gen6 NSv, Gen6 Hardware, Gen7 Hardware, Gen7 NSv, TZ80) 7.1 | See the advisory |
| SonicOS (Gen6 NSv, Gen6 Hardware, Gen7 Hardware, Gen7 NSv, TZ80) 8.0 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.