What does this mean exactly?
Overflow2021
Newbie ✭
in SSL VPN
Was there a credential leak? Just a brute force vulnerability?
IMPORTANT: SonicWall strongly advises that customers using GEN5 and GEN6 firewalls with SSLVPN users who have locally managed accounts immediately update their passwords to enhance security and prevent unauthorized access. Users can change their passwords if the "User must change password" option is enabled on their account. Administrators must manually enable the "User must change password" option for each local account to ensure this critical security measure is enforced.
IMPORTANT: SonicWall strongly advises that customers using GEN5 and GEN6 firewalls with SSLVPN users who have locally managed accounts immediately update their passwords to enhance security and prevent unauthorized access. Users can change their passwords if the "User must change password" option is enabled on their account. Administrators must manually enable the "User must change password" option for each local account to ensure this critical security measure is enforced.
Category: SSL VPN
Tagged:
0
Answers
It is quite specifically worded, isn't it? Whether your users have local accounts or are served by RADIUS/LDAP/whatever, whatever generation of firewall, then they should have strong passwords in any case, right?
So, like you, this suggests to me a credential leak in some specific versions of SonicOS.
Do you work for Sonicwall?
My question still stands.
The CVE is published for this
Security Advisory (sonicwall.com)
Revision History