High severity · published Oct 11, 2024
CVE-2024-45316
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to delete arbitrary folders and files, potentially leading to local privilege escalation attack.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CT
Connect Tunnel · SonicWall
12.4.3.271 and earlier versions · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45316
psirt.global.sonicwall.com
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0017
More from Connect Tunnel
6.1
CVE-2025-32817
A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthorized file overwrite, potentially leading…
5.5
CVE-2024-45315
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with…