SonicWall today advised customers to urgently fix several critical vulnerabilities affecting the company’s Global Management System (GMS) firewall management and Analytics network reporting engine software suites.

In total, the US cybersecurity company fixed a total of 15 security flaws today, including those that can allow threat actors to access vulnerable on-premises systems running GMS 9.3.2-SP1 or a earlier version and Analytics 2.5.0.4-R7 or earlier after bypassing authentication.

“This suite of vulnerabilities, for which responsibility has been disclosed, includes four (4) vulnerabilities with a CVSSv3 rating of CRITICAL, which allows an attacker to bypass authentication and could potentially lead to the exposure of sensitive information to an actor. unauthorized,” SonicWall said. said.

“SonicWall PSIRT strongly suggests organizations using the GMS/Analytics On-Prem version described below to upgrade to the respective patched version immediately.”

The list of critical vulnerabilities that administrators should fix immediately when upgrading to GMS 9.3.3 and Analytics 2.5.2 include:

• CVE-2023-34124: Web service authentication bypass
• CVE-2023-34133: multiple unauthenticated SQL injection issues and security filter bypass
• CVE-2023-34134: Reading password hash via web service
• CVE-2023-34137: CAS authentication bypass

They can be exploited remotely by unauthenticated malicious actors in low-complexity attacks that do not require user interaction.

Successful exploitation allows unauthorized access to data that would generally be inaccessible to an attacker, according to a security consulting released Wednesday.

This data may include information belonging to other users or any data within reach of the compromised application. Following the compromise, attackers can manipulate or delete this data, resulting in “persistent changes” to the content or functionality of the hacked application.

SonicWall PSIRT is not aware of any public reports of proof-of-concept (PoC) exploit code or active exploitation of this vulnerability occurring in the wild before bugs are disclosed and fixed.

Company devices have a history of being the target of ransomware (e.g., Hello Kitty, Five Hands) and cyber espionage attacks.

For example, in March, SonicWall PSIRT and Mandiant disclosed that suspected Chinese hackers custom malware installed on unpatched SonicWall Secure Mobile Access (SMA) appliances to achieve long-term persistence for cyber espionage campaigns.

SonicWall products are used by more than 500,000 enterprise customers in 215 countries and territories around the world, including government agencies and some of the world’s largest enterprises.