CVE-2013-1360

Vulnerability

An authentication bypass vulnerability exists in the Dell SonicWALL Global Management System (GMS) versions 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Management Appliance (UMA) 5.1, 6.0, and 7.0, and ViewPoint versions 4.1, 5.0, and 6.0. The flaw resides in the /sgms/ interface and is triggered by a crafted request, allowing a remote unauthenticated attacker to bypass authentication controls [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the /sgms/ endpoint of an affected SonicWALL GMS, Analyzer, UMA, or ViewPoint installation. No prior authentication or special network position is required beyond network access to the management interface [1][2].

Impact

Successful exploitation grants the attacker administrative access to the affected management system. This can lead to full compromise of the managed SonicWALL devices, including the ability to read and modify configuration, deploy malicious policies, and gain further network access [1][2].

Mitigation

Dell SonicWALL has not publicly released a fix for CVE-2013-1360 in the available references. Users should restrict network access to the /sgms/ interface to trusted IP addresses only, and consider upgrading to the latest supported versions if available. No workaround is provided in the references [1][2].