The question
This one's worth a straight answer because the details actually matter here — not every "critical vulnerability" headline is worth an emergency meeting, but this one is close.
What we told them
Two flaws were disclosed together in SonicWall's SMA1000 line (their remote-access appliances): one is a pre-authentication bug in the public-facing interface, the other lets an attacker who's gotten that far run commands on the device. Chained together, they add up to a full takeover — no valid login required. One of the two scored the maximum possible severity rating. CISA added both to its Known Exploited Vulnerabilities list and gave federal agencies a 72-hour window to patch, which is about as loud as that agency gets.
If you're not running SMA1000 specifically, you're not directly affected by this exact pair of CVEs. But the pattern is the part to actually absorb:
- Check what's actually internet-facing. The exposed devices in this incident were ones with their management or access interface reachable from the open internet — often left that way for convenience during setup and never locked back down.
- Firmware on edge devices needs the same patch cadence as your servers. Firewalls and VPN gateways don't show up in most people's mental model of "things that need patching Tuesday," but they're now a preferred target precisely because they're under-monitored.
- If you don't know your firewall's current firmware version off the top of your head, that's the actual finding here — not this specific CVE.
We checked their environment, confirmed their SonicWall model and firmware weren't in the affected range, and still tightened the management-interface exposure while we were in there. That second part is the one most people skip.
The device guarding your network is a bigger target than most of what's behind it. Patch edge hardware — firewalls, VPN gateways, remote-access appliances — on the same urgency you'd give a compromised server, not on whatever schedule is convenient.