Sonicos
Vendor:
First CVE: Apr 29, 2015 · Active for 11 years
69
Total CVEs
More Total CVEs than 99% of tracked products
6.9
Avg CVEs / Year
Higher CVE frequency than 93% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 48% of tracked products
4.3%
KEV Rate
Higher KEV Rate than 98% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Sonicos over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 29, 2015
11 years ago
Most Recent CVE
Apr 29, 2026
89 days ago
CVE Severity & Scoring
Sonicos69 CVEs
43%
39%
17%
All CVEs352,785 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local2 (2.9%)
Network63 (91.3%)
Unknown1 (1.4%)
Physical0 (0.0%)
Adjacent Network3 (4.3%)
Attack Complexity
Low64 (92.8%)
High4 (5.8%)
Unknown1 (1.4%)
User Interaction
None62 (89.9%)
Unknown1 (1.4%)
Required6 (8.7%)
Privileges Required
Low19 (27.5%)
High7 (10.1%)
None42 (60.9%)
Unknown1 (1.4%)
Top CVEs
Signals from CVEs in this product scope (69 CVEs).
69 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-53704CRITICAL An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. | Jan 9, 2025 | 9.8 | 98 | YES | YES |
CVE-2019-12255CRITICAL Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow. | Aug 9, 2019 | 9.8 | 81 | NO | YES |
CVE-2024-40766CRITICAL An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditi | Aug 23, 2024 | 9.8 | 80 | YES | NO |
CVE-2020-5135CRITICAL A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the fi | Oct 12, 2020 | 9.8 | 80 | YES | NO |
CVE-2019-12257HIGH Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdh | Aug 9, 2019 | 8.8 | 74 | NO | NO |
CVE-2022-22274CRITICAL A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code | Mar 25, 2022 | 9.8 | 63 | NO | NO |
CVE-2021-3449MEDIUM An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms | Mar 25, 2021 | 5.9 | 57 | NO | NO |
CVE-2019-12258HIGH Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options. | Aug 9, 2019 | 7.5 | 48 | NO | YES |
CVE-2019-12265MEDIUM Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 | Aug 9, 2019 | 5.3 | 48 | NO | NO |
CVE-2021-20031MEDIUM A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains. | Oct 12, 2021 | 6.1 | 46 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (69 CVEs).
CISA KEV
3 CVEs
4.3% of CVEs· 98th percentile
Metasploit
1 CVE
1.4% of CVEs· 97th percentile
Nuclei
2 CVEs
2.9% of CVEs· 97th percentile
ExploitDB
2 CVEs
2.9% of CVEs· 85th percentile
Social Chatter
Signals from CVEs in this product scope (69 CVEs).
Media Mentions
Signals from CVEs in this product scope (69 CVEs).
Top CNAs Publishing CVEs For Sonicos
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 8.0.0-8035 | 1 | 9.8 | 95.1% | 1 | 1 |
| 7.5.0.12 | 1 | 4.3 | 2.4% | 0 | 0 |
| 7.1.2-7019 | 1 | 9.8 | 95.1% | 1 | 1 |
| 7.1.1-7040 | 1 | 9.8 | 0.8% | 0 | 0 |
| 7.0.1.0 | 1 | 5.9 | 62.9% | 0 | 0 |
| 7.0.0.0 | 11 | 7.1 | 3.6% | 1 | 0 |
| 6.5.4.7-83n | 1 | 7.5 | 1.4% | 0 | 0 |
| 6.5.4.6-79n | 1 | 5.3 | 0.9% | 0 | 0 |
| 6.5.3.3-3n | 1 | 7.2 | 0.9% | 0 | 0 |
| 6.5.3.1 | 4 | 7.3 | 0.9% | 0 | 0 |
| 6.5.2.3-4n | 1 | 7.2 | 0.9% | 0 | 0 |
| 6.5.2.2 | 4 | 7.3 | 0.9% | 0 | 0 |
| 6.5.2.0 | 1 | 5.4 | 2.5% | 0 | 0 |
| 6.5.1.9-4n | 1 | 7.2 | 0.9% | 0 | 0 |
| 6.5.1.8 | 4 | 7.3 | 0.9% | 0 | 0 |
| 6.5.1.4-4n | 1 | 7.2 | 0.9% | 0 | 0 |
| 6.5.1.3 | 4 | 7.3 | 0.9% | 0 | 0 |
| 6.5.1.12-3n | 1 | 7.5 | 1.4% | 0 | 0 |
| 6.5.1.0 | 1 | 5.4 | 2.5% | 0 | 0 |
| 6.5.0.0 | 1 | 5.4 | 2.5% | 0 | 0 |