A recent analysis by cybersecurity firm Bishop Fox has revealed that over 25,000 publicly accessible SonicWall SSLVPN devices are vulnerable to critical security flaws. More concerning is that 20,000 of these devices are running outdated, unsupported firmware versions.

Key Findings:
– 430,363 SonicWall firewalls are publicly exposed
– 20,710 devices run end-of-life firmware
– 25,485 devices are vulnerable to critical severity issues
– 94,018 devices face high severity vulnerabilities

Security Implications:
The public exposure of management and SSL VPN interfaces creates opportunities for cyber attacks, including:
– Vulnerability exploitation
– Firmware targeting
– Misconfiguration abuse
– Password brute-force attempts

Firmware Status:
– Series 4 and 5: 6,633 devices (End of Life)
– Unsupported Series 6: 14,077 devices
– Unknown firmware versions: 13,827 devices
– Unidentified Series 6: 197,099 devices
– Unidentified Series 5: 29,254 devices

Recent exploitation of these vulnerabilities by ransomware groups, including Fog and Akira, highlights the urgent need for organizations to update their devices and implement proper security measures. While the number of vulnerable endpoints has decreased from 178,000 in January 2024 to 119,503, patch adoption remains concerningly slow.