CVE-2020-5135 is a buffer overflow vulnerability in SonicWall SonicOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 15 March 2022, which means attackers have used it in real attacks. A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.
What this vulnerability means in practice
A buffer overflow in firewall software is dangerous because it can corrupt memory in a network-facing security boundary that is meant to filter and inspect hostile traffic. In this case, a remote attacker can send a crafted request to trigger instability, disrupt availability, and in some conditions progress toward code execution on the appliance.
The key security issue is not just that the bug exists, but that it sits in an internet-reachable product that often protects many downstream systems at once. When that boundary fails, the impact can extend beyond a single device to the trust model for remote access, segmentation, and policy enforcement.
Why internet-facing firewalls are high-value targets
Security appliances are attractive because they are exposed to untrusted traffic, sit in front of multiple business services, and may be treated as trusted infrastructure by default. If an attacker can exploit memory corruption in the firewall itself, they may be able to bypass normal perimeter assumptions, interrupt connectivity, or gain a foothold inside the network edge.
This is why exploitation of perimeter devices is often more disruptive than exploitation of ordinary endpoints. A successful attack can affect many users and applications at once, and the compromised device may provide visibility into traffic, access paths, or administrative workflows that defenders rely on for containment.
How organisations assess exposure
Exposure checking starts with knowing exactly where SonicWall SonicOS is deployed, which appliances are internet-facing, and which ones are still reachable from untrusted networks. Teams should compare their asset inventory with vendor advisories and the NIST National Vulnerability Database or the CVE Program record for authoritative identifiers and references.
For a KEV-listed issue, the practical question is whether the vulnerable device is present, reachable, and still in service. That means confirming model coverage, deployment role, and whether the firewall is used for VPN, segmentation, or edge protection that would raise the urgency of remediation.
Remediation and verification after exposure
The right remediation path is to apply the vendor's fixed software or mitigation guidance as soon as operationally possible, then verify that the device is no longer exposed to the vulnerable path. When patching is delayed, reduce reachable attack surface with temporary compensating controls such as strict ingress restrictions, management-plane isolation, and tighter monitoring of the firewall's external interfaces.
After remediation, review the appliance for signs of pre-patch compromise rather than assuming the update alone resolves the incident. Firewall exploitation can leave behind configuration changes, unexpected accounts, altered logs, or unusual outbound activity, so post-patch validation should include compromise review as well as version confirmation.
Risk and Threat Considerations
This vulnerability carries both availability and integrity risk because a remote attacker can use a malicious request against a trusted perimeter device. The danger is amplified when the firewall is internet-facing, heavily relied upon, or used to protect many internal services behind a single point of failure.
Failure mechanism: A crafted request overflows memory in SonicOS, which can crash the appliance or, in some cases, allow arbitrary code execution on the firewall.
Impact: Attackers may cause denial of service, disrupt remote access, weaken perimeter trust, or use the device as an initial foothold for broader network compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | Exploit of an internet-facing firewall is a public-facing application compromise path. |
| Recommendation — Monitor exposed appliance services for exploitation attempts and correlate them with internet-facing attack surface. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The term requires asset scope, prioritisation, and remediation of an actively exploited vulnerability. |
| Recommendation — Prioritise KEV-listed appliances for rapid remediation and verify exposure against your asset inventory. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This vulnerability requires timely remediation and verification on affected security infrastructure. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment depends on identifying where the vulnerable SonicOS system exists and remains reachable. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on analysing logs and events for signs of compromise. | |
| Recommendation — Apply flaw remediation controls to patch or mitigate the firewall and confirm the fix was effective. Scan and inventory internet-facing appliances to confirm where the vulnerable SonicOS instance is deployed. Review firewall logs and related telemetry for indicators of exploitation before and after remediation. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org