CVE-2024-12805

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
SonicWall	SonicOS	6.5.4.15-117n and older versions; 7.0.1-5161 and older version; 7.1.2-7019; 8.0.0-8035

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0004

Timeline

Published: Jan 9, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-128064.9A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file.CVE-2024-128074.8The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privileg CVE-2024-128084.8The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not san CVE-2024-128096.4The Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishlist_button' shortcode in all versions CVE-2024-128108.1The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of dat CVE-2024-128118.8The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This make CVE-2024-128127.5The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected CVE-2024-128135.4The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-CVE-2024-128146.4The Loan Comparison plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'loancomparison' shortcode in all ver CVE-2024-128156.4The Point Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'point_maker' shortcode in all versions u CVE-2024-128166.4The NOTICE BOARD BY TOWKIR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'notice-board' shortcode in al CVE-2024-128176.4The Etsy Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_link' shortcode in all version