CVSS 7.5 (HIGH) · Actively exploited (listed in CISA KEV)
SonicOS SSLVPN contains an authentication enforcement vulnerability allowing users with valid alternate credentials to bypass SAML controls. This flaw can also circumvent SAML-enforced multi-factor authentication, potentially compromising account security.
Attackers may gain unauthorized access by bypassing MFA requirements, leading to potential data breaches or system compromise.
Apply vendor mitigations immediately and ensure compliance with CISA BOD 26-04 guidelines. Evaluate internet exposure and discontinue use if mitigations are unavailable.
SonicOS SSLVPN 存在身份驗證強制漏洞，允許擁有有效替代憑證的使用者繞過 SAML 控制。此漏洞亦可能規避 SAML 強制之多因素驗證，危及帳戶安全。
立即套用廠商緩解措施並遵守 CISA BOD 26-04 指引。若無法緩解，請評估網路暴露風險並停止使用該產品。