SonicWall End-of-Life GMS Flaws Leave Users Exposed with No Patch Coming
Written by AI from the linked story. Not reviewed by an editor. How this works
SonicWall's Global Management System (GMS) versions 9.5.2 and earlier contain two critical unpatched vulnerabilities that allow unauthenticated attackers to steal sensitive data or perform SQL injection attacks. Because the software has reached end-of-life, SonicWall will not issue patches, leaving any organization still running GMS permanently exposed. This incident highlights the severe risk of continuing to operate unsupported software in production environments, particularly network management platforms that hold privileged credentials and configuration data. Organizations must treat end-of-life software as a critical vulnerability in its own right and have migration timelines well before vendor support ends.
Tactical Insight
Immediate actions
- Migrate all GMS 9.5.2 and earlier deployments to SonicWall Network Security Manager (NSM) or an equivalent supported platform immediately.
- Isolate or take offline any GMS instances that cannot be migrated immediately to prevent unauthenticated remote exploitation.
- Conduct a network-wide audit to identify all other end-of-life or unsupported software currently in use.
Long-term improvements
- Maintain a formal software lifecycle inventory that tracks vendor support end dates and triggers migration projects at least 12 months before EOL.
- Establish a policy requiring executive sign-off and a documented risk acceptance for any software continued in use beyond vendor end-of-life.
- Integrate vendor EOL announcements into the organization's vulnerability management program so they are treated with the same urgency as CVEs.
Detection measures
- Deploy continuous vulnerability scanning tools configured to flag unsupported and end-of-life software versions across all networked assets.
- Monitor network traffic to and from management platforms for anomalous unauthenticated access attempts or unexpected SQL query patterns.