More than 178,000 SonicWall firewalls are exposed to old denial of service bugs

More than 178,000 SonicWall firewalls are still vulnerable to years-old vulnerabilities, an infosec reseacher claims. A study by Jon Williams, senior security engineer at Bishop Fox, this week highlights what he refers to as weapons-grade patch apathy from SonicWall customers, with the number of exploitable devices …

[Pascal Monett]

"This is a constant task, that is not easy"

Not saying the contrary, but if you're in the firewall business, by now that is a task you should have mastered.

[Paul Crawford]

Sigh, seems my comment today has just been reinforced:

https://forums.theregister.com/forum/all/2024/01/15/juniper_networks_rce_flaw/#c_4792453

[Youngone]

Sonicwall?

I thought they died years ago. We had a couple of their firewalls at one place I worked at, but the support was so poor we got rid of them.

[John Klos]

They're missing the real reason so many SonicWalls are unpatched

One thing SonicWall is known for (besides horrible devices, insane defaults and employees that don't know anything about networking) is that EVERYTHING costs money. If you're not paying for constant support for your devices, you don't get updates. Even if you do pay, you don't always get updates if your equipment is "too old", even when the hardware is literally the exact same guts as the "new" device - you're told you must buy the new device.

SonicWall is a bad, scammy company. Anyone who runs in to issues with their SonicWall devices should be encouraged to get better devices.

[Anonymous Coward]

Re: They're missing the real reason so many SonicWalls are unpatched

OK, so with Meraki if you do not pay the device is disabled after 30 days? At least the SonicWALL will pass malware for you if the support is not paid as exemplified by the study ;). SonicWALL and Meraki both have the merit that they will relicense used equipment so this makes the cost of entry a lot lower. They often do promotions where you can get the hardware "free" if you buy two or three years of support up front. SonicWALL is generally a lot less expensive that the big guys to boot. A very good value proposition is why SonicWALL is still around and growing. They made two acquisitions in the last couple of months so they seem to be doing OK.

[Youngone]

Re: They're missing the real reason so many SonicWalls are unpatched

I don't think anyone is thinking that Cisco are less scummy than Sonicwall.

[thosrtanner]

weapons-grade patch apathy

The guy who came up with that phrase deserves one of these ================>

[43300]

"The other problem that many organizations also face is a resourcing problem when it comes to patching, there's a constant deluge of vulnerabilities that need to be triaged and then acted on accordingly."

Yes to an extent, but of all the devices which might need patching the firewalls should really be one of the top priorities!