CVE-2020-5148 - SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewall access controls

Back Back to CVE browser

HIGH

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewall access controls

Published Mar 5, 2021

8.2

HIGH

CVSS 3.1

EPSS 0.89%

Description

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewall access controls.

Affected products

Vendor SonicWall Product Directory Services Connector Default
unknown
Affected
- 4.1.17 and earlier

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
SonicWall	Directory Services Connector	unknown	Affected 4.1.17 and earlier

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26395
Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0003
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26395		Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0003		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sonicwall

Published Mar 5, 2021

Updated Aug 4, 2024

Reserved Dec 31, 2019

Link CVE-2020-5148

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-5148

Red Hat

No data

ENISA EUVD

Assigner sonicwall

Published Mar 5, 2021

Updated Aug 4, 2024

Link EUVD-2020-26395

GitHub

No data