Patch for Sonic Firewall vulnerability CVE-2022-22274 – not for all products

[German]Another small addendum from the end of March 2022. There is a vulnerability (CVE-2022-22274) in SonicOS, the operating system for Sonic firewalls, which allows DoS attacks. The manufacturer has now also developed and released an update to close the vulnerability. However, it looks like this update is not offered for all products.

I came across this issue a few days ago via the following tweet, which is explained by the colleagues at Bleeping Computer here.

The vulnerability CVE-2022-22274 was found in SonicOS – as you can read on the linked page. It is a stack buffer overflow that allows a remote attacker to cause a Denial of Service (DoS) attack via HTTP requests or possibly execute code in the firewall. The vulnerability has received a CVE score of 9.4 and is therefore considered critical.

This vulnerability only affects the web management interface, the SonicOS SSLVPN interface is not affected. SonicWall PSIRT is not aware of any active exploitation of the vulnerability. Also, no PoC reports have been published and malicious exploitation of this vulnerability has not been reported to SonicWall, the March 25, 2022 advisory states. SonicWall strongly advises organizations using the affected SonicWall firewalls listed in this SonicWall document to follow the guidance provided.

The vendor offers firmware updates for affected products to close the vulnerability, according to this advisory. However, there is no update for the NSsp 15700 yet, administrators should continue with SonicWall's suggested measures (see also this article) to temporarily mitigate CVE-2022-22274 to avoid exploitation. Or, one can contact SonicWall's support team for a hotfix firmware (7.0.1-5030-HF-R844). SonicWall expects an official firmware release with the required patches for NSsp15700 to be available in mid-April 2022.