# SonicWall Gen6 VPN Vulnerability Exploited in Wild: Firmware Updates Alone Don't Stop Attackers


Threat actors are actively exploiting a critical vulnerability in SonicWall Gen6 SSL-VPN appliances that allows them to bypass multi-factor authentication (MFA) and establish footholds in enterprise networks within minutes. The vulnerability, tracked as CVE-2024-12802, has been weaponized in real-world attacks since at least February 2026, according to research from cybersecurity firm ReliaQuest. The most alarming aspect: many organizations believe their devices are protected after applying firmware patches—but critical manual remediation steps are required to actually close the vulnerability.


## The Threat


Attackers are leveraging the CVE-2024-12802 vulnerability to gain unauthorized access to internal networks by brute-forcing VPN credentials and completely bypassing MFA protections on SonicWall Gen6 SSL-VPN devices. ReliaQuest researchers detected multiple intrusions between February and March 2026 and assessed with medium confidence that these represent the first confirmed in-the-wild exploitation of the vulnerability.


The attack pattern is swift and deliberate:


  • Initial access: Attacker brute-forces VPN credentials using valid usernames
  • MFA bypass: The vulnerability allows authentication to proceed without satisfying MFA requirements
  • Internal reconnaissance: Within 30–60 minutes, the attacker conducts network scanning and tests credential reuse on internal systems
  • Lateral movement: Attacker establishes persistence via RDP using shared local administrator credentials
  • Post-exploitation: Attacker attempts to deploy Cobalt Strike beacons and vulnerable drivers to disable endpoint protection

    • In the incidents analyzed by ReliaQuest, one attacker compromised a domain-joined file server in approximately 30 minutes after gaining VPN access. The threat actors then tried to install a Cobalt Strike beacon and load a vulnerable driver using the Bring Your Own Vulnerable Driver (BYOVD) technique to circumvent endpoint detection and response (EDR) solutions. While EDR successfully blocked the malicious payloads in these cases, the speed of lateral movement demonstrates the urgency of patching.


    ## Background and Context


    The CVE-2024-12802 vulnerability was first disclosed by SonicWall, but the vendor's response created a dangerous operational complexity that many organizations have failed to address. The core issue stems from missing MFA enforcement for the UPN (User Principal Name) login format, allowing attackers with valid credentials to authenticate directly and sidestep multi-factor authentication entirely.


    The critical distinction between device generations:


    | Device Generation | Mitigation Required |

    |---|---|

    | Gen6 | Firmware update + manual LDAP reconfiguration (6-step process) |

    | Gen7 & Gen8 | Firmware update only |


    This disparity has created a false sense of security. Many organizations patched their Gen6 devices but skipped the manual remediation steps outlined in SonicWall's advisory, believing the firmware update alone was sufficient—exactly what the Akira ransomware gang exploited in 2025 when targeting SonicWall SSL VPN devices.


    SonicWall Gen6 appliances reached end-of-life (EOL) on April 16, 2026, meaning the vendor will no longer release security updates. Organizations still running Gen6 hardware are in an increasingly precarious position, particularly if they have not completed the full remediation process.


    ## Technical Details


    The vulnerability's root cause is straightforward but devastating in practice. When organizations deploy LDAP authentication with the "Qualified login name" field configured to use userPrincipalName, the SonicWall appliance fails to enforce MFA requirements during the authentication process. An attacker with valid credentials—obtained through credential stuffing, leaked databases, or brute force—can authenticate using the UPN format and completely bypass MFA checks.


    Mandatory remediation steps for Gen6 devices:


    1. Delete the existing LDAP configuration using userPrincipalName in the "Qualified login name" field

    2. Remove locally cached/listed LDAP users

    3. Remove the configured SSL VPN "User Domain" (reverts to LocalDomain)

    4. Reboot the firewall

    5. Recreate the LDAP configuration without userPrincipalName in the "Qualified login name" field

    6. Create a fresh backup to prevent restoring a vulnerable configuration later


    The researchers noted a particularly insidious aspect of the exploitation: malicious logins using the UPN format appeared as normal MFA flows in SonicWall logs, allowing defenders to believe MFA protections were working when they were actually compromised.


    ## Threat Actor Profile and Attribution


    ReliaQuest's analysis suggests the threat actor is likely an initial access broker (IAB)—a specialized attacker who gains entry into networks and sells access to other criminal groups. The evidence includes:


  • Deliberate logout and re-login activities separated by days
  • Multiple accounts used across different intrusion attempts
  • Testing of credential reuse and internal system access, consistent with reconnaissance for resale
  • Rapid abandonment of the network after initial foothold establishment

    • This profile is critical: the threat actor is not necessarily the final attacker. These intrusions could precede ransomware deployments, data theft operations, or other sophisticated attacks by downstream threat groups.


    ## Indicators of Compromise and Detection


    ReliaQuest identified several key signals that can help defenders hunt for exploitation activity in their environment:


  • sess="CLI" — This signal indicates scripted or automated VPN authentication and is a strong indicator of brute-force attacks
  • Event IDs 238 and 1080 — Associated with suspicious VPN login activity
  • Logins from suspicious VPS/VPN infrastructure — Attacker IP addresses that appear to originate from cloud providers or VPN services rather than residential networks
  • Failed MFA followed by successful login — Attempts to bypass MFA that eventually succeed
  • Unusual LDAP authentication patterns — Multiple failed attempts before successful UPN-based authentication

    • Organizations should search their VPN logs for these indicators immediately, paying particular attention to the sess="CLI" signal, which strongly correlates with automated exploitation attempts.


    ## Implications for Organizations


    Immediate risk exposure:


    Organizations running unpatched or incompletely patched Gen6 SonicWall devices are at critical risk. The vulnerability allows attackers to:


  • Bypass MFA entirely, negating one of the most important security controls
  • Gain internal network access within minutes
  • Establish persistence for later ransomware or data theft operations
  • Operate largely undetected in network logs

    • Broader supply chain concerns:


    SonicWall appliances are deployed across diverse sectors—healthcare, finance, manufacturing, and government. The research indicates exploitation "across multiple sectors and geographies," suggesting no industry is immune. A single unpatched Gen6 device can become the entry point for a network-wide compromise.


    The false patching problem:


    This incident highlights a recurring challenge in cybersecurity: partial mitigation. Organizations that applied firmware updates without completing the manual remediation steps believe their devices are secure when they are not. This creates a dangerous asymmetry where defenders have false confidence while attackers actively exploit the gap.


    ## Recommendations


    Immediate actions (within 24–48 hours):


    1. Audit Gen6 device status: Identify all SonicWall Gen6 SSL-VPN appliances in your environment and confirm their current firmware version

    2. Verify remediation completion: Confirm that the six-step LDAP reconfiguration outlined in SonicWall's advisory has been completed, not just firmware updates applied

    3. Hunt for indicators: Search VPN logs for the indicators identified by ReliaQuest, particularly the sess="CLI" signal and event IDs 238/1080

    4. Enable enhanced logging: Ensure that all VPN authentication attempts are logged with sufficient detail to detect anomalies


    Medium-term actions (1–2 weeks):


    1. Plan hardware migration: Begin planning replacement of Gen6 devices with Gen7 or Gen8 appliances, which require only firmware updates for full CVE-2024-12802 remediation

    2. Review VPN access policies: Implement IP whitelisting for VPN access where possible to prevent logins from suspicious infrastructure

    3. Strengthen credential hygiene: Conduct a password audit for all accounts with VPN access and reset potentially compromised credentials

    4. Deploy MFA hardening: For VPN access, implement hardware-backed or certificate-based MFA beyond simple software tokens, which can be more resistant to bypass attempts


    Long-term strategy:


    1. Maintain vendor support: Do not rely on EOL hardware for critical security functions. Plan hardware refresh cycles that align with vendor support timelines

    2. Adopt zero-trust network access: Move beyond perimeter-based VPN security toward zero-trust architectures that verify every access attempt, regardless of network location

    3. Continuous monitoring: Implement network detection and response (NDR) and EDR solutions to detect lateral movement attempts even if initial access is obtained


    ## HackWire Analysis


    CVE-2024-12802 exemplifies a recurring failure mode in enterprise cybersecurity: the dangerous gap between *perceived* and *actual* patching. Organizations patched their Gen6 appliances and felt secure, but SonicWall's dual-requirement for both firmware updates and manual reconfiguration created a complexity that many missed entirely. This is not a novel vulnerability requiring zero-days or advanced techniques—it's simple credential brute-force against an improperly configured authentication system. Yet it has enabled actual compromises across multiple sectors.


    What makes this incident particularly concerning is the timing: Gen6 reached EOL just weeks ago, meaning thousands of organizations are now running unsupported hardware that will never receive another security patch. This is an upstream problem that started with product lifecycle management, not just tactical patching. The researchers' assessment that the threat actor is likely an IAB suggests these intrusions are the *beginning* of a broader attack campaign, not isolated incidents.


    For defenders, the signal is clear: firmware version numbers alone are insufficient assurance of security. You must verify that all remediation steps outlined in vendor advisories have been completed. For Gen6 SonicWall users still in operation, this is an urgent priority. For those planning hardware refresh, the lesson is to avoid EOL hardware whenever possible and build security refresh cycles into capital planning, not just react to crises.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)