CVE-2024-29014: SonicWall NetExtender RCE Vulnerability

CVE-2024-29014 Overview

CVE-2024-29014 affects the SonicWall SMA100 NetExtender Windows client, versions 10.2.339 and earlier, across both 32-bit and 64-bit builds. An attacker can achieve arbitrary code execution by manipulating the Endpoint Control (EPC) Client update process. The vulnerability is classified under [CWE-94] Improper Control of Generation of Code, which typically indicates that untrusted input influences code that the client subsequently executes. SonicWall published the issue on July 18, 2024, and tracks the advisory as SNWLID-2024-0011.

Critical Impact
A network-adjacent attacker with low privileges can execute arbitrary code on Windows endpoints running vulnerable NetExtender clients, compromising remote access users and their host systems.

Affected Products

SonicWall NetExtender Windows client (32-bit) version 10.2.339 and earlier
SonicWall NetExtender Windows client (64-bit) version 10.2.339 and earlier
SonicWall SMA100 series appliances using the affected NetExtender clients

Discovery Timeline

2024-07-18 - CVE-2024-29014 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29014

Vulnerability Analysis

The SonicWall NetExtender Windows client performs Endpoint Control (EPC) update checks as part of its SSL VPN connection workflow. During this update handling, the client processes attacker-influenced content in a way that enables arbitrary code execution on the endpoint. The flaw is a code injection weakness cataloged under [CWE-94], meaning untrusted data is incorporated into instructions the client later executes. The EPSS score of 1.864% (77.3 percentile) reflects meaningful exploitation interest relative to the broader CVE population.

Root Cause

The root cause resides in how the NetExtender client validates and applies EPC Client update payloads. When update content is not adequately authenticated or sanitized, an adversary can substitute or tamper with the update stream. The client then treats the crafted payload as trusted code, allowing execution in the security context of the NetExtender process on the user's Windows machine.

Attack Vector

Exploitation requires a network path to the client and some level of privilege, consistent with an attacker positioned to intercept or influence VPN traffic. An adversary controlling network traffic between the client and the SMA100 appliance, or one able to redirect the client to a rogue endpoint, can deliver a malicious EPC update. Successful exploitation yields full code execution with impact to confidentiality, integrity, and availability of the endpoint. See the SonicWall Vulnerability Advisory SNWLID-2024-0011 for vendor-confirmed details.

No public proof-of-concept exploit or verified code sample is available for this vulnerability. Refer to the vendor advisory for technical specifics on the update handling flow.

Detection Methods for CVE-2024-29014

Indicators of Compromise

Unexpected child processes spawned by NetExtender.exe or related NetExtender service binaries on Windows endpoints
New or modified executables in NetExtender installation directories following a VPN connection attempt
Outbound VPN connections to SMA100 hostnames that do not match sanctioned corporate gateways
EPC update transactions completing from non-standard network paths or unexpected TLS certificates

Detection Strategies

Monitor process lineage for NetExtender components launching interpreters such as powershell.exe, cmd.exe, or wscript.exe
Alert on file writes to NetExtender program directories by processes other than SonicWall installer components
Inspect TLS traffic to SMA100 gateways for certificate anomalies and unexpected redirections during EPC update handshakes

Monitoring Recommendations

Inventory Windows endpoints running NetExtender and flag any at or below version 10.2.339
Ingest endpoint process, file, and network telemetry into a central data lake to correlate EPC update events with post-connection endpoint behavior
Track SonicWall PSIRT advisories for follow-on fixes and companion CVEs affecting SMA100 clients

How to Mitigate CVE-2024-29014

Immediate Actions Required

Upgrade all SonicWall NetExtender Windows clients (32-bit and 64-bit) to a version later than 10.2.339 as directed by SNWLID-2024-0011
Restrict SMA100 VPN access to trusted networks and enforce strict egress controls on endpoints running NetExtender
Audit endpoints for prior EPC update activity and investigate any anomalous process or file changes

Patch Information

SonicWall provides fixed NetExtender Windows client builds through the SonicWall Vulnerability Advisory SNWLID-2024-0011. Administrators should deploy the patched client to all endpoints and confirm the reported client version is above 10.2.339 after installation.

Workarounds

Where immediate patching is not possible, disable use of the vulnerable NetExtender Windows client and route users through alternate remote access methods
Constrain NetExtender endpoints to trusted network segments to reduce exposure to attacker-controlled update paths
Enforce least-privilege on Windows accounts that connect through NetExtender to limit the scope of any successful code execution

bash

# Query installed NetExtender version on a Windows endpoint
reg query "HKLM\SOFTWARE\SonicWall\NetExtender" /v Version
# Confirm the reported build is greater than 10.2.339 after patching