VxWorks and Sonicwall woes

Armis has discovered 11 security vulnerabilities in VxWorks real-time operating system TCP stack. VxWorks powers many IoT devices as it requires minimal hardware but it also is the base for SonicWall Firewalls. TCP needs to be exposed to the internet for the Sonicwall to pass packets back and forth. It is unknown if Sonicwall has mitigations to limit this kind of behavior. I expect not since they have an URGENT patch update notice. There have been no sightings in the wild but that can change quickly.

PATCH NOW!

Sidenote if you can’t manage your Sonicwall or you get error ERR_SSL_VERSION_OR_CIPHER_MISMATCH use Internet Explorer, Gear/Settings, Internet options, Advanced Tab, scroll way down and check Use SSL 3.0 and Use TLS 1.0. OR try using the K-Melon browser. Some of these issues are fixed after SonicWall patch 5.8.1