DOS Vulnerability discovered in SonicWall Next-Generation Firewall

THREAT LEVEL: Amber

For a detailed advisory, download the pdf file here

SonicWall, a manufacturer of security hardware discovered a flaw in their SonicOS security operating system that allows denial of service (DoS) attacks and could lead to remote code execution (RCE).

The identified vulnerability (CVE-2022-22274) affects TZ Series desktop form factor next-generation firewalls (NGFW) for small and medium-sized organizations (SMBs), Network Security Virtual (NSv) cloud-security firewalls, and Network Security Services Platform (NSsp) high-end firewalls. A remote unauthenticated attacker can cause a Denial of Service (DoS) or perhaps code execution in the firewall by exploiting an unauthenticated stack-based buffer overflow in SonicOS via an HTTP request.

We strongly advise administrators to limit SonicOS management access to trusted sources (and/or disable management access from untrusted internet sources) until organizations can update their operating systems to patch the vulnerability. This can be done by modifying the existing SonicOS management access rules (SSH/HTTPS/HTTP).

Potential MITRE ATT&CK TTPs are:

TA0001: Initial Access

TA0003: Persistence

TA0004: Privilege Escalation

TA0005: Defense Evasion

TA0040: Impact

TA0042: Resource Development

T1499: Endpoint Denial of Service

T1499.001: Endpoint Denial of Service: OS Exhaustion Flood

T1574: Hijack Execution Flow

T1588: Obtain Capabilities

T1588.006: Obtain Capabilities: Vulnerabilities

T1190: Exploit Public-Facing Application

Vulnerability Details

Affected Products

References

https://www.sonicwall.com/support/notices/security-notice-critical-unauthenticated-stack-based-buffer-overflow-vulnerability-in-sonicos/220323160744440/