PT-2022-6179 · Sonicwall · Sonicos

Published 2022-03-25 · Updated 2026-03-01 · CVE-2022-22274

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SonicOS (affected versions not specified)

Description A Stack-based buffer overflow vulnerability in SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall. The vulnerability is related to the web interface management of the SonicOS operating system and is associated with the possibility of a stack buffer overflow. It is estimated that over 178,000 SonicWall next-generation firewalls with exposed management interfaces are potentially affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2023-00346

CVE-2022-22274

Affected Products

Sonicos

References · 44

• 🔥 https://github.com/BishopFox/CVE-2022-22274_CVE-2023-0656 · Exploit
• 🔥 https://github.com/4lucardSec/Sonic_CVE-2022-22274_poc · Exploit
• 🔥 https://github.com/pwneddr/Sonic_CVE-2022-22274_poc · Exploit
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0003 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00346 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22274 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22274 · Vendor Advisory
• https://t.me/aptreports/26375 · Telegram Post
• https://twitter.com/bishopfox/status/1747378341395783989 · Twitter Post
• https://twitter.com/geeknik/status/1747083801396641876 · Twitter Post
• https://twitter.com/CyberConvoy/status/1747655858798952608 · Twitter Post
• https://t.me/thehackernews/4410 · Telegram Post
• https://twitter.com/YourAnonRiots/status/1747454947745317217 · Twitter Post
• https://twitter.com/XynikIT/status/1747264539643830568 · Twitter Post
• https://twitter.com/JFrogSecurity/status/1747946474569072872 · Twitter Post