# CVE-2020-5135: SonicWall SonicOS Buffer Overflow Vulnerability

Source: https://junglewise.ai/threats/cve-2020-5135-sonicwall-sonicos-buffer-overflow-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-15. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2020-5135 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-03-15

A stack-based buffer overflow vulnerability in SonicWall SonicOS allows a remote unauthenticated attacker to cause a Denial of Service (DoS) or potentially execute arbitrary code. The flaw is triggered by sending a specially crafted malicious request to the firewall's management interface.

Technologies: [SonicWall SonicOS](https://junglewise.ai/threats/technologies/sonicos). Vendors: [SonicWall](https://junglewise.ai/threats/vendors/sonicwall).

## Quick answers

**Is CVE-2020-5135 exploited in the wild?** Yes. CVE-2020-5135 is known to be exploited in the wild, first recorded on 15 March 2022. Treat it as urgent.

**How severe is CVE-2020-5135?** Critical severity, with a CVSS score of 9.8, published 15 March 2022.

**Which products and versions are affected?** SonicWall SonicOS 6.0.5.3, 6.5.1.12, 6.5.4.7, 7.0.0.0; SonicWall SonicOSv 6.5.4.v.

**Is there a fix for CVE-2020-5135?** A patch was published on 2022-04-05: CISA due date for applying vendor updates Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-5135 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2020-5135?** Check whether you run SonicWall SonicOS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- SonicWall SonicOS 6.0.5.3, 6.5.1.12, 6.5.4.7, 7.0.0.0
- SonicWall SonicOSv 6.5.4.v

## Timeline

- 2020-10-12: disclosed: NVD Published Date
- 2022-03-15: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2022-04-05: patched: CISA due date for applying vendor updates

## Related threats

- [SonicWall SonicOS heap-based buffer overflow in SSL-VPN](https://junglewise.ai/threats/cve-2026-82308-a-pre-authentication-heap-based-buffer-overflow-vulnerability-has)
- [SonicWall SonicOS heap buffer overflow in TACACS+ client](https://junglewise.ai/threats/cve-2026-77709-a-pre-authentication-heap-based-buffer-overflow-vulnerability-has)
- [SonicWall SonicOS stack-based buffer overflow in TACACS+ client](https://junglewise.ai/threats/cve-2026-77708-a-pre-authentication-stack-based-buffer-overflow-vulnerability)
- [SonicWall SonicOS SSLVPN SAML authentication bypass](https://junglewise.ai/threats/cve-2026-19868-an-authentication-enforcement-vulnerability-in-sonicos-sslvpn)
- [SonicWall SonicOS weak password hashing](https://junglewise.ai/threats/cve-2026-19703-a-weak-password-hashing-vulnerability-has-been-identified-on)