CVE-2020-5135
Published 2020-10-12 · Updated 2026-06-17 · Source PSIRT@sonicwall.com
Summary
CVE-2020-5135 is a critical-severity (CVSS 9.8) vulnerability in SonicWall SonicOS. CISA added it to the Known Exploited Vulnerabilities catalog on March 15, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 5, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. SonicWall has 20 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.
All 20 known-exploited SonicWall vulnerabilities →Description
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: SonicWall — SonicOS
Name: SonicWall SonicOS Buffer Overflow Vulnerability
Date added: 2022-03-15 · Due: 2022-04-05
Required action: Apply updates per vendor instructions.