In SonicWall SonicOS, administrators without full permissions can download imported certificates.

Published 7 y ago 2019-02-19 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.5

v3.1 · NVD

CISA KEV

not known exploited

EPSS

0.2%

percentile 11%

Public exploits

none known

In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).

Exploit prediction (EPSS)

0.21% probability of exploitation in the next 30 days, higher than 11% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	5.5	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:P/I:N/A:N`

Affected products

SonicWall SonicOS
SonicWall SonicOSv

Classification

Weakness

CWE-285 Improper Authorization
CWE-732 Incorrect Permission Assignment for Critical Resource

References

psirt.global.sonicwall.com /vuln-detail/SNWLID-2018-0017 · x_refsource_CONFIRM, x_transferred
tenable.com /security/research/tra-2019-08 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2018-9867
NVD: CVE-2018-9867

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.