CVE-2024-53702

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-05 · updated 2026-06-17
Weakness: CWE-338

Description

Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret.

Affected products

SonicWall Sma 200 Firmware: before 10.2.1.14-75sv — fixed in 10.2.1.14-75sv
SonicWall Sma 210 Firmware: before 10.2.1.14-75sv — fixed in 10.2.1.14-75sv
SonicWall Sma 400 Firmware: before 10.2.1.14-75sv — fixed in 10.2.1.14-75sv
SonicWall Sma 410 Firmware: before 10.2.1.14-75sv — fixed in 10.2.1.14-75sv
SonicWall Sma 500V Firmware: before 10.2.1.14-75sv — fixed in 10.2.1.14-75sv

How to fix

Upgrade to a fixed version: SonicWall Sma 200 Firmware 10.2.1.14-75sv; SonicWall Sma 210 Firmware 10.2.1.14-75sv; SonicWall Sma 400 Firmware 10.2.1.14-75sv; SonicWall Sma 410 Firmware 10.2.1.14-75sv; SonicWall Sma 500V Firmware 10.2.1.14-75sv. Check the vendor advisory for mitigations.

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018

Get alerted when CVE-2024-53702 or the next vulnerability affects your stack