Medium severity · published Oct 11, 2024
CVE-2024-45315
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to create arbitrary folders and files, potentially leading to local Denial of Service (DoS) attack.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CT
Connect Tunnel · SonicWall
12.4.3.271 and earlier versions · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45315
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45315
psirt.global.sonicwall.com
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0017
More from Connect Tunnel
7.8
CVE-2024-45316
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with…
6.1
CVE-2025-32817
A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthorized file overwrite, potentially leading…