CVE-2024-12802: SonicWALL SSL-VPN MFA Bypass Vulnerability

CVE-2024-12802 Overview

CVE-2024-12802 is a critical authentication bypass vulnerability affecting SonicWALL SSL-VPN when integrated with Microsoft Active Directory. The vulnerability arises from the separate handling of User Principal Name (UPN) and Security Account Manager (SAM) account names, which allows Multi-Factor Authentication (MFA) to be configured independently for each login method. Attackers can potentially bypass MFA protections by exploiting the alternative account name format that may not have MFA enforcement applied.

Critical Impact

This vulnerability enables attackers to completely bypass MFA security controls on SonicWALL SSL-VPN, potentially granting unauthorized network access without completing the required second authentication factor.

Affected Products

• SonicWALL SSL-VPN (when integrated with Microsoft Active Directory)
• SonicWALL SSL-VPN deployments using UPN and SAM account configurations
• Environments with inconsistent MFA policies across login methods

Discovery Timeline

• 2025-01-09 - CVE CVE-2024-12802 published to NVD
• 2025-01-09 - Last updated in NVD database

Technical Details for CVE-2024-12802

Vulnerability Analysis

This vulnerability is classified under CWE-305 (Authentication Bypass by Primary Weakness), which occurs when an authentication mechanism fails to adequately verify the identity of a user. In the case of CVE-2024-12802, the flaw stems from an architectural weakness in how SonicWALL SSL-VPN handles different Active Directory account name formats.

When organizations integrate SonicWALL SSL-VPN with Microsoft Active Directory, users can authenticate using either their UPN format (e.g., user@domain.com) or their SAM account name format (e.g., DOMAIN\username). The vulnerability exists because these two authentication paths are treated as separate entities within the MFA configuration, allowing administrators to inadvertently—or unknowingly—leave one login method without MFA protection while securing the other.

Root Cause

The root cause of this vulnerability lies in the compartmentalized handling of UPN and SAM account names within SonicWALL's authentication framework. Rather than applying MFA policies uniformly across all valid login formats for a single user identity, the system treats each format independently. This design decision creates a security gap where MFA enforcement on one account name format does not automatically extend to the alternative format, even though both represent the same user account in Active Directory.

Attack Vector

An attacker can exploit this vulnerability through network-based access to the SSL-VPN login portal. The attack requires no prior authentication and no user interaction, making it particularly dangerous for internet-facing VPN deployments.

The attack scenario involves an attacker identifying that MFA is configured for one account format but not the other. By attempting authentication using the unprotected account name format (either UPN or SAM, depending on the configuration), the attacker can successfully authenticate without completing MFA challenges, effectively bypassing this critical security control.

For example, if an organization has configured MFA enforcement for UPN-based logins (user@company.com), an attacker who discovers or guesses valid credentials could attempt login using the SAM format (COMPANY\user) to circumvent the MFA requirement entirely. This attack requires valid credentials but completely negates the protection that MFA is designed to provide against credential compromise.

For detailed technical information, refer to the SonicWall Security Advisory SNWLID-2025-0001.

Detection Methods for CVE-2024-12802

Indicators of Compromise

• Authentication logs showing successful VPN logins without corresponding MFA challenge completion events
• Users authenticating via SAM account name format when organizational policy mandates UPN format (or vice versa)
• Unusual login patterns where the same user account authenticates using different name formats
• VPN access from unexpected geographic locations or IP addresses without MFA verification
• Failed MFA attempts on one account format followed by successful authentication on the alternative format

Detection Strategies

• Configure SIEM rules to correlate VPN authentication events with MFA verification logs, alerting on successful logins lacking MFA completion
• Monitor for authentication attempts using both UPN and SAM formats for the same user within short time windows
• Implement behavioral analytics to detect login pattern anomalies, particularly users switching between account name formats
• Review SSL-VPN authentication logs for discrepancies between login method and expected MFA policy enforcement

Monitoring Recommendations

• Enable verbose logging on SonicWALL SSL-VPN appliances to capture complete authentication event details including account name format used
• Deploy network detection tools to monitor SSL-VPN traffic patterns and identify potential unauthorized access attempts
• Establish baseline authentication patterns for users and alert on deviations, particularly changes in login format preference
• Regularly audit MFA configuration to ensure both UPN and SAM account formats have consistent policy enforcement

How to Mitigate CVE-2024-12802

Immediate Actions Required

• Review current MFA configuration on all SonicWALL SSL-VPN appliances to verify MFA is enforced for both UPN and SAM account name formats
• Audit authentication logs to identify any potential exploitation attempts where MFA was bypassed
• Apply the latest security patches from SonicWall as referenced in the vendor advisory
• Consider temporarily restricting SSL-VPN access to a single account name format until consistent MFA enforcement is verified
• Notify security operations teams to increase monitoring of VPN authentication events

Patch Information

SonicWall has released a security advisory addressing this vulnerability. Organizations should consult the SonicWall Security Advisory SNWLID-2025-0001 for specific patch versions and update instructions. Apply the recommended firmware updates to all affected SonicWALL SSL-VPN appliances immediately to remediate this MFA bypass vulnerability.

Workarounds

• Enforce a single account name format policy (either UPN or SAM exclusively) at the Active Directory and SSL-VPN configuration level to eliminate the bypass vector
• Implement network segmentation and conditional access policies to limit VPN access scope even if authentication bypass occurs
• Configure SSL-VPN to require certificate-based authentication in addition to credentials and MFA
• Deploy additional access controls such as IP whitelisting or geo-blocking to reduce the attack surface
• Enable account lockout policies to limit brute-force attempts against either account format

# Review SonicWALL SSL-VPN authentication configuration
# Ensure MFA policies are applied consistently across all login methods
# Consult SonicWall documentation for specific CLI commands based on firmware version
# Example: Verify MFA settings for both UPN and SAM in the management interface
# Settings > Users > Local Users & Groups > Authentication Methods
# Confirm "Require MFA" is enabled for all applicable authentication domains