Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

SonicWall SSL‑VPN allows remote deletion of any file

CVE-2007-5815 · published 19 years ago
Summary

The WebCacheCleaner component in SonicWall SSL‑VPN devices (models 200, 2000, and 4000) can be tricked into deleting any file on the system. An attacker can send a specially crafted request that tells the software to remove a file by its full path. Update the SSL‑VPN firmware to the latest version or apply the vendor’s patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sonicwall ssl_vpn_200 <= 2.1
cpe:2.3:a:sonicwall:ssl_vpn_200:*:*:*:*:*:*:*:*
sonicwall ssl_vpn2000\/4000 <= 2.5
cpe:2.3:a:sonicwall:ssl_vpn2000\/4000:*:*:*:*:*:*:*:*
Original advisory text
Absolute path traversal vulnerability in the WebCacheCleaner ActiveX control 1.3.0.3 in SonicWall SSL-VPN 200 before 2.1, and SSL-VPN 2000/4000 before 2.5, allows remote attackers to delete arbitra...
Absolute path traversal vulnerability in the WebCacheCleaner ActiveX control 1.3.0.3 in SonicWall SSL-VPN 200 before 2.1, and SSL-VPN 2000/4000 before 2.5, allows remote attackers to delete arbitrary files via a full pathname in the argument to the FileDelete method.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published5 Nov 2007
Updated24 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-5815 · NVD
Track software like this
Free during beta