CVE-2024-12803

CVE-2024-12803 is a post-authentication stack-based buffer overflow vulnerability (CWE-121) in the SonicOS management interface of SonicWall firewalls. It affects the SonicOS component, enabling a remote attacker with authenticated access to trigger the overflow, which can crash the firewall and potentially lead to arbitrary code execution.

The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low attack complexity but requiring high privileges (PR:H), such as administrative credentials. An authenticated attacker can exploit it remotely without user interaction to achieve high impacts on confidentiality, integrity, and availability, including denial of service via firewall crashes and potential remote code execution on the affected device.

SonicWall has published a detailed advisory on the vulnerability under identifier SNWLID-2025-0004, available at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0004.