SonicWall SSL-VPN CVE-2024-12802: Your Firmware Update Left 6 Steps Undone

CVE-2024-12802 exploits a fundamental authentication flow problem in SonicWall Gen6 SSL-VPN appliances integrated with Microsoft Active Directory. The bypass works by exploiting separate handling of two AD login formats.

User Principal Name (UPN) is the modern authentication format user@domain.com. MFA enforcement is configured on this login path, requiring a one-time password, hardware token, or push notification challenge after a successful password validation. Security Account Manager (SAM) account name is the legacy format DOMAIN\user. On vulnerable Gen6 devices, this login path does not trigger the MFA challenge even when MFA is globally enabled across the VPN configuration.

The critical weakness is in how the SonicWall LDAP integration routes authentication requests. When an attacker possesses valid credentials, they authenticate using the SAM account name format. The appliance validates the Active Directory password successfully but routes the request through a code path that has no MFA enforcement hook. The authentication completes without any one-time password, push notification, or hardware token challenge.

Attackers exploit this with automated brute-force tools targeting the SAM login path. Because authentication attempts via the SAM path do not generate standard failed-MFA alerts, security monitoring systems register the brute-force traffic as ordinary failed login attempts rather than MFA bypass events. ReliaQuest documented cases where as few as 13 attempts separated the attacker from a valid credential, with post-exploit activity appearing in logs as clean, successful authentication events.

The bypass is particularly dangerous for organizations that deployed MFA specifically as a compensating control for VPN access. CVE-2024-12802 breaks that assumption entirely for Gen6 hardware: MFA provides zero protection against an attacker using the SAM authentication path.

SonicWall issued a firmware update for CVE-2024-12802 in 2025. Applying that update is necessary but not sufficient. The firmware patch does not remove the existing LDAP configuration that enables the UPN-to-SAM authentication path discrepancy. Any Gen6 device that received the firmware upgrade and stopped there remains fully exploitable.

Full remediation for Gen6 devices requires six manual steps performed after the firmware update. These steps reconfigure the LDAP integration to eliminate the dual-path authentication discrepancy that the vulnerability exploits. The process takes 20 to 45 minutes per appliance for an experienced network administrator.

The firmware version check produces a false compliant result in most vulnerability management platforms. This is the critical operational failure: security teams receive a green dashboard status, close the remediation ticket, and move on, while the underlying LDAP configuration continues to allow MFA bypass. Cybersecurity Dive reported that patch status reporting tools checking only firmware version will show a patched status on devices that are still fully exploitable.

Organizations managing mixed Gen6 and Gen7 fleets face a compounding problem. Gen7 and newer devices are fully remediated by the firmware patch alone, requiring no manual LDAP reconfiguration. The different remediation requirements across hardware generations create a gap where Gen6 devices in a mixed fleet appear compliant while remaining vulnerable to CVE-2024-12802.

SonicWall Gen6 appliances reached end-of-life status on April 16, 2026. End-of-life means SonicWall no longer provides firmware updates, security patches, or technical support for these devices. The six-step remediation procedure closes CVE-2024-12802, but Gen6 hardware will accumulate additional unpatched vulnerabilities with no resolution path from the vendor.

Affected Gen6 models include the SonicWall TZ300, TZ400, TZ500, TZ600, NSa 2650, NSa 3650, NSa 4650, NSa 5650, NSa 6650, and NSa 9250 series. Any of these models integrated with Active Directory and running SSL-VPN is affected by CVE-2024-12802 unless all six manual remediation steps have been completed following the firmware update.

The exploitation window has been running since at least February 2026. ReliaQuest documented active campaigns between February and March 2026 across multiple enterprise environments. BleepingComputer reported fresh exploitation beginning May 20, 2026, with confirmed victims in manufacturing, healthcare, and professional services. The median attacker dwell time between initial VPN authentication and reaching an internal file server was under 30 minutes across documented incidents.

For organizations that cannot immediately migrate from Gen6 hardware, three short-term mitigations reduce exposure while the six-step remediation is scheduled. First, disable SSL-VPN access on Gen6 appliances entirely and route remote access through an alternative path. Second, restrict VPN access via IP allowlists covering only corporate egress addresses, blocking all VPS and residential IP ranges. Third, monitor SonicWall event logs for Event IDs 238 and 1080, which flag scripted authentication patterns and session cycling consistent with brute-force exploitation.

Akira is a ransomware-as-a-service operation first documented in 2023 that consistently targets network perimeter appliances as initial access vectors. Akira-affiliated operators represent a structured criminal organization with dedicated specialists for scanning, credential exploitation, and ransomware deployment. As covered in our Cisco SD-WAN authentication bypass analysis, authentication bypass vulnerabilities in network perimeter hardware remain the highest-value entry point for ransomware groups because they provide persistent access that bypasses all perimeter controls.

Following CVE-2024-12802 exploitation, Akira operators execute a consistent post-exploitation sequence. Within the first 30 minutes, they perform network reconnaissance using standard Windows tools, test credential reuse on internal systems accessible from the VPN subnet, and establish Remote Desktop Protocol connections using shared administrator passwords recovered from Active Directory. Within the next two hours, operators attempt Cobalt Strike beacon deployment and use Bring Your Own Vulnerable Driver techniques to disable endpoint detection tools.

Data exfiltration precedes encryption. Akira operators spend 24 to 72 hours enumerating file shares, identifying backup locations, and staging sensitive data for exfiltration before executing the ransomware payload. Ransom demands in Akira campaigns targeting mid-size enterprises have ranged from $200,000 to $2.5 million, with double-extortion pressure applied through an Akira data leak site that publishes victim files when negotiations fail.

Organizations can correlate Akira activity with attacker infrastructure documented by Huntress: VPS addresses from AS62240 (Clouvider), AS23470 (ReliableSite), and AS174 (COGENT). New Active Directory accounts named backupSQL and lockadmin are post-exploitation staging indicators consistent with Akira pre-encryption operations.

Detection of CVE-2024-12802 exploitation requires monitoring SonicWall event logs for authentication patterns that distinguish bypass attempts from normal user behavior. Standard SIEM alerts for failed MFA events will not fire during exploitation, the bypass produces clean, successful authentication events with no MFA failure recorded.

Key SonicWall log indicators: Event ID 238 (SSL-VPN session created) with sess=CLI value indicates scripted authentication via automated tools rather than a human-operated VPN client. Event ID 1080 (SSL-VPN user disconnected) in high-frequency clusters from the same source IP indicates brute-force credential cycling. Authentication successes from IP ranges associated with VPS providers, Clouvider AS62240, ReliableSite AS23470, COGENT AS174, with no prior organizational login history warrant immediate investigation and session termination.

Post-exploitation Active Directory indicators: new accounts named backupSQL or lockadmin are staging accounts created by Akira-affiliated operators. PowerShell remoting or WMI activity originating from the VPN subnet directed at internal file servers is a lateral movement indicator. Set-MpPreference execution disabling Windows Defender from a VPN-authenticated session and netsh.exe firewall rule modifications from VPN-connected hosts are pre-ransomware staging signals. Event log clearing via EventLogSession.ClearLog from VPN-authenticated endpoints indicates imminent ransomware deployment and requires immediate containment response.

The SonicWall SSL-VPN MFA bypass CVE-2024-12802 represents a category of vulnerability that defeats the security controls organizations rely on most. MFA is treated as the primary compensating control for VPN access because passwords alone cannot stop credential-stuffing attacks. This vulnerability nullifies that protection entirely for Gen6 hardware, and the false-patched status in vulnerability dashboards means most affected organizations do not know they are exposed.

The exploitation evidence from ReliaQuest and BleepingComputer shows that breached organizations believed they were protected. The firmware upgrade showed patched in vulnerability management tools. Detection failed because the bypass produces clean authentication events with no failed-MFA alerts. The full breach chain from initial brute-force to file server access completed before any security alert fired.

As documented in our Palo Alto PAN-OS firewall remediation coverage, perimeter network appliances continue to be the highest-impact initial access targets for organized threat actors. SonicWall Gen6 now sits in the same risk category: an EOL device, actively exploited, with a partial patch that a significant percentage of affected organizations believes is complete.

Three actions define the right response today. Identify every Gen6 SSL-VPN appliance in your environment. Query each one for LDAP configuration using userPrincipalName as the login attribute. Execute the six-step LDAP remediation sequence on each device before end of business. Organizations that cannot complete remediation today should disable SSL-VPN on Gen6 appliances immediately and route remote access through alternative infrastructure while scheduling the LDAP reconfiguration work.