Lucene search

[email protected]CVE-2022-22273

HistoryMar 17, 2022 - 2:15 a.m.

CVE-2022-22273

2022-03-1702:15:06

CWE-78

[email protected]

web.nvd.nist.gov

cve-2022-22273

os command injection

sra vulnerability

sma 100 series firmware

nvd

security advisory

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.6%

JSON

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions

Affected configurations

NVD

Node

sonicwallsma_200_firmwareRange≤9.0.0.9-26sv

AND

sonicwallsma_200Match-

Node

sonicwallsma_210_firmwareRange≤9.0.0.9-26sv

AND

sonicwallsma_210Match-

Node

sonicwallsma_400_firmwareRange≤9.0.0.9-26sv

AND

sonicwallsma_400Match-

Node

sonicwallsma_410_firmwareRange≤9.0.0.9-26sv

AND

sonicwallsma_410Match-

Node

sonicwallsma_500v_firmwareRange≤9.0.0.9-26sv

AND

sonicwallsma_500vMatch-

Node

sonicwallsra_4200_firmwareRange≤9.0.0.5-19sv

AND

sonicwallsra_4200Match-

Node

sonicwallsra_4600Match-

AND

sonicwallsra_4600_firmwareRange≤9.0.0.5-19sv

Node

sonicwallsra_1600Match-

AND

sonicwallsra_1600_firmwareRange≤9.0.0.5-19sv

Node

sonicwallsra_1200Match-

AND

sonicwallsra_1200_firmwareRange≤9.0.0.5-19sv

CPENameOperatorVersion
sonicwall:sma_200_firmwaresonicwall sma 200 firmwarele9.0.0.9-26sv

CPE	Name	Operator	Version
sonicwall:sma_200_firmware	sonicwall sma 200 firmware	le	9.0.0.9-26sv

CNA Affected

[
  {
    "product": "SonicWall SRA/SMA100",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "SRA Series 9.0.0.5-19sv and earlier versions."
      },
      {
        "status": "affected",
        "version": "SMA100 Series 9.0.0.9-26sv and earlier versions."
      }
    ]
  }
]

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0001

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.6%

JSON

Related for CVE-2022-22273

vulnrichment1 prion1 cvelist1 nvd1