nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-5135 CVE-2020-5135
CRITICALCISA KEVRansomware
SonicWall SonicOS Buffer Overflow Vulnerability
Record summary
CVE-2020-5135 has a selected CVSS score of 9.8 (critical). CISA lists CVE-2020-5135 in KEV; VulnCheck reports CVE-2020-5135 use in known ransomware campaigns.
Description
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
Description source: CVE List
Exploitation context
Known exploitation
- CISA KEV
- Listed · Mar 15, 2022 · CISA
- VulnCheck KEV
- Listed · Mar 15, 2022 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
- Ransomware use
- Observed · VulnCheck
CISA SSVC decision
ExploitationActive
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 6, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
SonicOSBrowse SonicWall / SonicOS | CISA, CVE List | SonicOS 6.5.4.7-79n and earlier | affected |
| SonicOS 6.5.1.11-4n and earlier | affected | ||
| SonicOS 6.0.5.3-93o and earlier | affected | ||
| SonicOSv 6.5.4.4-44v-21-794 and earlier | affected | ||
| SonicOS 7.0.0.0-1 | affected |
References
3psirt.global.sonicwall.comConfirmation
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0010 cisa.govGovernment resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5135