Germany's Federal Office for Information Security (BSI) has warned that attackers are targeting SonicWall firewalls, according to a report by Golem — a familiar headline for anyone who follows edge-device security, and a reminder of why firewalls remain one of the most valuable footholds in a corporate network.
The attraction is structural. A firewall or VPN concentrator sits on the internet by design, runs with high privileges, is often years behind on patches because rebooting it means interrupting everyone's access, and frequently logs to a console nobody reads. Compromise it and you are already inside: no phishing required, no user to fool, and legitimate encrypted traffic to hide in.
SonicWall's SSL-VPN and secure mobile access appliances have been recurring targets. The company has issued urgent advisories in the past urging customers to patch immediately or to disable internet-exposed management interfaces and unused SSL-VPN services — guidance that, by the fact it keeps being repeated, clearly does not always reach the administrators who need it. Campaigns against such devices tend to follow a similar shape: mass scanning for exposed login portals, fingerprinting of firmware versions, then exploitation of a known flaw or straightforward credential attacks using reused, leaked or default passwords. From a VPN foothold, intruders typically harvest credentials, move laterally and stage ransomware.
For administrators, the practical checklist is well established. Apply vendor patches and firmware updates now rather than at the next maintenance window. Turn off SSL-VPN, SSH or management access from the internet if it is not strictly needed, and restrict what remains to specific IP addresses or an internal jump host. Enforce multi-factor authentication and audit local accounts for stale or shared credentials. Enable logging and actually review it, hunt for the indicators of compromise the vendor and the BSI publish alongside such warnings, segment the network so that a compromised appliance is not a path to the domain controller, and keep offline backups. Assume that any device exposed to the internet is being scanned continuously — because it is.
BSI product warnings of this kind are usually accompanied by concrete mitigation lists for the affected models, and administrators running SonicWall hardware should treat them as action items rather than background noise. The wider lesson is the one that keeps repeating across vendors and years: the devices we put at the edge to keep attackers out are the ones they work hardest to get into.
