CVE-2007-5603: sonicwall ssl_vpn

CVSS: 9.3v2.0HighModified

Published 05-11-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-5603 is a high (CVSS 9.3) vulnerability in sonicwall ssl_vpn. EPSS estimates a 37.98% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

37.98%

0%100%

High · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database, metasploit

Timeline

05-11-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Stack-based buffer overflow in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51, and 2.5.x before 2.5.0.56, allows remote attackers to execute arbitrary code via a long string in the second argument to the AddRouteEntry method.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

37.98%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 37.98% on 19-09-2026

19-09-202619-10-2026

EPSS score

37.98%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databaseremotewindowsVerified
SonicWALL SSL-VPN - 'NeLaunchCtrl' ActiveX Control Remote Command Execution
Maturity: weaponized
exploit-databaseremotewindowsVerified
SonicWALL SSL-VPN - NetExtender ActiveX Control Buffer Overflow (Metasploit)
Maturity: weaponized

Show all 4 exploits

MetasploitremoteUnverified
SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow
exploit/windows/browser/sonicwall_addrouteentry
Maturity: poc

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Sonicwall1 product

ssl_vpn≤ 2.1 | ≤ 2.5

1 vendor · 1 product

References

12 links

www.kb.cert.org/vuls/id/WDON-78K56MX Refsource MISC
www.kb.cert.org/vuls/id/298521Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.vupen.com/english/advisories/2007/3696VDB EntryX Refsource VUPEN
www.sec-consult.com/fileadmin/Advisories/20071101-0_sonicwall_multiple.txtX Refsource MISC
www.exploit-db.com/exploits/4594ExploitX Refsource EXPLOIT DB
securityreason.com/securityalert/3342Third Party AdvisoryX Refsource SREASON
www.securityfocus.com/bid/26288VDB EntryX Refsource BIDExploit
www.securitytracker.com/id?1018891VDB EntryX Refsource SECTRACK
secunia.com/advisories/27469Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/483097/100/0/threadedMailing ListX Refsource BUGTRAQ

Show all 12 references

exchange.xforce.ibmcloud.com/vulnerabilities/38220VDB EntryX Refsource XF
www.sec-consult.com/303.htmlX Refsource MISC

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities