Medium severity · published Jan 18, 2024
CVE-2023-6340
SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Capture Client · Sonicwall
through 3.7.10 · source: NVD
NE
Netextender · Sonicwall
through 10.2.337 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6340
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6340
Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0019
More from Capture Client
7.4
CVE-2021-3450
CA certificate check bypass with X509_V_FLAG_X509_STRICT
5.9
CVE-2021-3449
NULL pointer deref in signature_algorithms processing