MySonicWall Cloud Backup Files Exposed

Executive Summary

On September 17, 2025, SonicWall announced a security incident for users of the MySonicWall service. SonicWall has stated that some customers may be impacted by an incident that left firewall configuration backup files exposed to threat actors via the MySonicWall service.  Threat actors with access to a firewall configuration file may have an easier time exploiting the network that the firewall is protecting.  As a result, customers are encouraged to log in to MySonicWall to determine if their firewall’s backup configuration file may have been exposed and should take prompt remediation action.

Details

Note: information about this exploit is still emerging.

Maintaining cloud backups of firewall configurations is a best practice, as they let you quickly restore or replace a device after misconfiguration, hardware failure, or during an upgrade. Configuration files contain critical settings and encrypted credentials, and therefore present a valuable target for threat actors, revealing exactly what traffic is allowed or blocked. If local user accounts are included in VPN configurations, those accounts provide specific targets for brute-force attacks.

SonicWall reports that firewall configuration and backup files may have been exposed to threat actors, which could pose a significant risk to affected customers.

Impact

Successful exploitation of an impacted firewall would allow a threat actor to perform the following actions:

• Remote access compromise:  Attackers would gain access to a target’s network
• Privilege escalation: Unauthorized access allows elevation to administrative roles.
• Lateral movement & persistence: Internal resources scanned and abused using built-in OS tools and scripting
• Data exfiltration: Sensitive business data is being exfiltrated prior to ransomware payload execution.
• Ransomware deployment: Ransomware deployed within the network

Mitigation Strategies

1. Disable HTTP/HTTPS & SSH Management over the WAN
2. Disable or restrict access to SSL VPN, IPSEC VPN, and SNMP until the actions below have been completed.
3. Disable or restrict inbound WAN access to internal services allowed via NAT/Access Rules.
4. Ensure your SonicWall device is on the latest firmware version.
5. For all local accounts
   1. Ensure Password expiry and complexity are enabled.
   2. Ensure password lengths of at least 14 characters.
   3. Ensure TOTP is enabled for all users
   4. Force re-enroll of all local users
6. Change all passwords associated with:
   1. IPSec VPN
   2. L2TP/PPPoE/PPTP
   3. AWSAPI
   4. SNMP
   5. WWAN
   6. DDNS
   7. Clearpass
   8. Email logs
   9. FTP servers for logging
   10. Switches managed by the firewall
   11. Wireless interfaces
   12. SonicPoint/SonicWave
   13. RADIUS
   14. Guest Services
   15. SSO shared secrets
   16. SMTP/POP Appflow
   17. NTP
   18. Signature Proxy
   19. SSLVPN
   20. GMS-Legacy
   21. Advanced Routing

Sources

• MySonicWall Cloud Backup File Incident
• Essential Credential Reset

Contributing Authors

• Daniel Felzke, Senior Director of DFIR, Dataprise