CVE-2024-12802

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-305

Affected software

No affected versions have been published.

Timeline

Published: Jan 9, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-128037.2A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and poten CVE-2024-128057.2A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads t CVE-2024-128064.9A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file.CVE-2024-128074.8The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privileg CVE-2024-128084.8The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not san CVE-2024-128096.4The Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishlist_button' shortcode in all versions CVE-2024-128108.1The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of dat CVE-2024-128118.8The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This make CVE-2024-128127.5The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected CVE-2024-128135.4The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-CVE-2024-128146.4The Loan Comparison plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'loancomparison' shortcode in all ver CVE-2024-128156.4The Point Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'point_maker' shortcode in all versions u