SonicWall Refuses to Patch Critical EoL GMS Flaws, Leaving Users Exposed
Written by AI from the linked story. Not reviewed by an editor. How this works
SonicWall's decision not to patch two high-severity vulnerabilities in end-of-life GMS 9.3.2 and earlier — including an unauthenticated file read (CVSS 9.1) and a SQL injection flaw — highlights the acute risk of running unsupported software in production environments. Organizations that delay migrating away from EoL products inherit all future vulnerabilities with no vendor safety net, while adversaries actively probe for exactly these unpatched systems. The active exploitation of a related SSRF flaw (over 2,500 documented attempts) confirms that threat actors specifically target legacy SonicWall infrastructure. This situation matters because network management systems typically have privileged access to the entire security stack, meaning a single compromise can cascade across the entire environment. Maintaining an accurate EoL tracking program is not optional — it is a foundational security hygiene requirement.
Tactical Insight
Immediate actions
- Upgrade all SonicWall GMS 9.3.2 and earlier deployments to the supported Network Security Manager (NSM) platform immediately.
- Isolate or firewall any EoL GMS instances from internet-facing exposure until migration is complete.
- Run an emergency authenticated scan of GMS systems to detect any signs of SQL injection or unauthorized file access exploitation.
Long-term improvements
- Maintain a continuously updated asset inventory that flags software approaching or past its vendor end-of-life date, triggering a mandatory migration plan.
- Establish a formal EoL policy that requires approved migration timelines and risk-acceptance sign-off at the CISO level for any system running beyond vendor support.
- Implement network segmentation to ensure management platforms like GMS are never directly reachable from untrusted networks or the public internet.
Detection measures
- Deploy file integrity monitoring and database activity monitoring on management systems to detect anomalous file reads or unexpected SQL queries indicative of exploitation.
- Integrate threat intelligence feeds into your SIEM to alert on known CVEs actively being exploited in the wild, enabling faster response when vendor patches are unavailable.