CVE-2023-6340: sonicwall capture_client Stack-based Buffer Overflow

Vulnerability summary

CVE-2023-6340 is a medium (CVSS 5.5) Stack-based Buffer Overflow vulnerability in sonicwall capture_client. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.9% of scored vulnerabilities.

Timeline

1. 17-01-2024
   PublishedVulnerability first disclosed.
2. 11-06-2025
   Last modifiedVulnerability information updated.

Description

SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.