CVE-2024-29012: SonicWall SonicOS DoS Vulnerability

CVE-2024-29012 Overview

CVE-2024-29012 is a stack-based buffer overflow vulnerability in the SonicOS HTTP server. An authenticated remote attacker can trigger the flaw through improper use of the sscanf function, leading to a Denial of Service (DoS) condition on the affected firewall. The vulnerability affects a wide range of SonicWall NSA, NSsp, NSv, and TZ series appliances running vulnerable SonicOS firmware. Successful exploitation can crash the management HTTP server, disrupting administrative access and potentially the security services provided by the appliance. SonicWall assigned this issue tracker ID SNWLID-2024-0008 and published a firmware update to address it.

Critical Impact
Authenticated remote attackers can crash the SonicOS HTTP server on internet-facing firewalls, disrupting management and security services across the perimeter.

Affected Products

SonicWall SonicOS firmware on NSA series appliances (NSA 2700, 3700, 4700, 5700, 6700)
SonicWall SonicOS firmware on NSsp series (NSsp 10700, 11700, 13700) and NSv series (NSv 270, 470, 870)
SonicWall SonicOS firmware on TZ series (TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570P, TZ570W, TZ670)

Discovery Timeline

2024-06-20 - CVE-2024-29012 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29012

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow ([CWE-121]) with an out-of-bounds write component ([CWE-787]) in the SonicOS HTTP management server. The overflow occurs when the HTTP server parses attacker-supplied input using the sscanf function without validating the length of the destination buffer on the stack. Writing past the allocated buffer corrupts adjacent stack memory, including saved registers and return addresses, causing the HTTP process to terminate abnormally.

Because the flaw lives in the management HTTP server, exploitation requires authentication and network reachability to the appliance's administrative interface. The resulting crash produces a Denial of Service, blocking legitimate administrators from managing the firewall until the service recovers or the device restarts.

Root Cause

The root cause is unsafe use of the sscanf format-string parser inside the SonicOS HTTP server. sscanf conversion specifiers such as %s do not enforce a maximum field width by default, so a longer-than-expected input token is written directly into a fixed-size stack buffer. Missing bounds checks on the source string allow the write to exceed the buffer size and corrupt the stack frame.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the SonicOS management interface. The malformed request contains a field long enough to overflow the destination buffer during sscanf parsing, corrupting the stack and crashing the HTTP server process. Exploitation is remote and network-based, but requires valid administrative session credentials. No user interaction is required.

The issue is described in prose only; no verified proof-of-concept has been published. Refer to the SonicWall Vulnerability Advisory SNWLID-2024-0008 for vendor-confirmed technical details and fixed firmware versions.

Detection Methods for CVE-2024-29012

Indicators of Compromise

Unexpected crashes or restarts of the SonicOS HTTP management service recorded in appliance system logs.
HTTP requests to the SonicOS management interface containing abnormally long query parameters or URI components from authenticated sessions.
Sudden loss of administrative access to the firewall following a specific inbound HTTP request.

Detection Strategies

Correlate SonicOS audit logs of authenticated administrator sessions with subsequent management-plane service failures.
Alert on HTTP requests to the appliance management interface where input fields exceed expected length thresholds.
Track repeated authentication followed by immediate management-plane unavailability, which suggests probing for the overflow condition.

Monitoring Recommendations

Forward SonicOS syslog and event data to a centralized SIEM and alert on HTTP server process termination events.
Monitor for successful admin logins originating from unexpected IP ranges, especially outside change-management windows.
Track firewall availability and management-interface reachability so that DoS attempts trigger operational alerts.

How to Mitigate CVE-2024-29012

Immediate Actions Required

Upgrade affected SonicOS firmware to the fixed version listed in SonicWall advisory SNWLID-2024-0008.
Restrict access to the SonicOS management interface (HTTP/HTTPS) to trusted administrative networks only.
Rotate administrator credentials and review recent authenticated sessions for anomalous activity.

Patch Information

SonicWall has released firmware updates that address the sscanf overflow in the SonicOS HTTP server. Consult the SonicWall Vulnerability Advisory SNWLID-2024-0008 for the specific fixed firmware versions applicable to each NSA, NSsp, NSv, and TZ platform. Apply the vendor-supplied firmware as soon as change control permits.

Workarounds

Disable HTTP/HTTPS management access on WAN interfaces and rely on VPN or out-of-band management until firmware is applied.
Enforce management access ACLs so only known administrator IP addresses can reach the SonicOS web interface.
Enable multi-factor authentication for all administrative accounts to reduce the risk of credential compromise enabling exploitation.

bash

# Example: restrict SonicOS management access to a trusted admin subnet
# (apply via SonicOS CLI or management UI as appropriate for your platform)
configure
address-object ipv4 Admin_Subnet network 10.10.0.0 255.255.255.0
firewall access-rule from LAN to Firewall service HTTPS source Admin_Subnet action allow
firewall access-rule from WAN to Firewall service HTTPS action deny
commit