Authentication Bypass by Primary Weakness in SonicOS - CVE-2024-12802
Published: January 8, 2025 / Updated: May 22, 2026
Vulnerability identifier: #VU102458
CSH Severity: High
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-12802
CWE-ID: CWE-305
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to bypass MFA protection.
The vulnerability exists due to the separate handling of UPN (User Principal Name) and SAM
(Security Account Manager) account names when integrated with Microsoft
Active Directory, allowing MFA to be configured independently for each login method and
potentially enabling attackers to bypass MFA by exploiting the
alternative account name.
Affected software
SonicOS
How to mitigate CVE-2024-12802
Install updates from vendor's website.
SonicOS - addressed in versions 6.5.4.4-44v-21-2472, 6.5.5.1-6n, 7.0.1-5165, 7.1.3-7015, 8.0.0-8037