What it is about

SonicWall Email Security ist eine mehrschichtige Vor-Ort-Lösung, die vor fortschrittlichen E-Mail-Bedrohungen schützt. Ein entfernter, authentisierter Angreifer mit Administratorrechten kann mehrere Schwachstellen in SonicWall Email Security Appliance ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Daten zu manipulieren oder einen Denial-of-Service-Zustand herbeizuführen.

Under what conditions?

Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.

What can happen in the worst case

An attacker could use the vulnerability to

• einen Cross-Site Scripting Angriff durchzuführen
• Daten zu manipulieren oder einen Denial-of-Service-Zustand herbeizuführen

Am I affected?

Affected according to the BSI:

• SonicWall Email Security Appliance 5000 <10.0.35.8405
• SonicWall Email Security Appliance 5050 <10.0.35.8405
• SonicWall Email Security Appliance 7000 <10.0.35.8405
• SonicWall Email Security Appliance 7050 <10.0.35.8405
• SonicWall Email Security Appliance 9000 <10.0.35.8405
• SonicWall Email Security Appliance Hyper-V <10.0.35.8405

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• SonicWall Email Security Appliance 5000 10.0.35.8405
• SonicWall Email Security Appliance 5050 10.0.35.8405
• SonicWall Email Security Appliance 7000 10.0.35.8405
• SonicWall Email Security Appliance 7050 10.0.35.8405
• SonicWall Email Security Appliance 9000 10.0.35.8405
• SonicWall Email Security Appliance Hyper-V 10.0.35.8405

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.