SonicWall Releases Security Update for SonicOS

Security update addresses a critical vulnerability that could allow a DoS attack or lead to RCE

Threat ID:: CC-4066
Threat Severity:: Information only
Published:: 29 March 2022 3:37 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update addresses a critical vulnerability that could allow a DoS attack or lead to RCE

Affected platforms

The following platforms are known to be affected:

Versions: 7.0.1-5050 and earlier, 7.0.1-R579 and earlier, 6.5.4.4-44v-21-1452 and earlier

SonicWall SonicOS

Impacted platforms:

SonicOS 7.0.1-5050 and earlier - Applies to TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSv 270, NSv 470, NSv 870
SonicOS 7.0.1-R579 and earlier - Applies to NSsp 15700
SonicOS 6.5.4.4-44v-21-1452 and earlier - NSv 10, NSv 25, NSv 50, NSv 100, NSv 200, NSv 300, NSv 400, NSv 800, NSv 1600

Threat details

Introduction

SonicWall has released security updates to address a critical stack-based buffer overflow vulnerability in the SonicOS via HTTP request. This vulnerability, tracked as CVE-2022-22274, could allow a remote unauthenticated attacker to carry out a denial-of-service (DoS) attack or potentially cause remote code execution (RCE) in the firewall.

Remediation advice

Affected organisations are encouraged to review the SonicWall security advisory SNWLID-2022-0003 and Critical Unauthenticated Stack-Based Buffer Overflow Vulnerability In SonicOS security notification page and apply the relevant updates or workarounds.

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2022-22274

A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall.

Last edited: 29 March 2022 3:38 pm