QID 375410

Date Published: 2021-03-25

QID 375410: Sonicwall SSO-AGENT NetApi Vulnerability

SonicWall Directory Connector with SSO provides the Configuration Tool as the administrative interface. It includes configuration screens for local and remote SonicWall Single Sign-On Agents (SSO Agents), SonicWall network security appliances, and the various types of servers that the SSO Agent needs to access.

CVE-2020-5148: SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network.

Affected Version:
Directory Services Connector version 4.1.17 and earlier versions
Detection Logic:(Authenticated)
This QID will check the version of SSOAgentService.exe version NOTE: SonicWall SSO agent is ONLY affected if NetAPI is selected as a client probing method. This is a Microsoft NetAPI vulnerability and NetWkstaUserEnum request that it uses.

Successful exploit could allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewall access controls.

  • CVSS V3 rated as Critical - 8.2 severity.
  • CVSS V2 rated as High - 6.4 severity.
    • Solution
    Vendor has released fix to address these vulnerabilities. Refer to SNWLID-2021-0003
    Vendor References

    CVEs related to QID 375410

    CVE-2020-5148 |
    Software Advisories
    Advisory ID Software Component Link
    SNWLID-2021-0003 WIndows URL Logo psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0003
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].