DOS Vulnerability discovered in SonicWall Next-Generation Firewall

Threat Level – Amber | Vulnerability Report
Download PDF

THREAT LEVEL: Amber

For a detailed advisory, download the pdf file here

SonicWall, a manufacturer of security hardware discovered a flaw in their SonicOS security operating system that allows denial of service (DoS) attacks and could lead to remote code execution (RCE).

The identified vulnerability (CVE-2022-22274) affects TZ Series desktop form factor next-generation firewalls (NGFW) for small and medium-sized organizations (SMBs), Network Security Virtual (NSv) cloud-security firewalls, and Network Security Services Platform (NSsp) high-end firewalls. A remote unauthenticated attacker can cause a Denial of Service (DoS) or perhaps code execution in the firewall by exploiting an unauthenticated stack-based buffer overflow in SonicOS via an HTTP request.

We strongly advise administrators to limit SonicOS management access to trusted sources (and/or disable management access from untrusted internet sources) until organizations can update their operating systems to patch the vulnerability. This can be done by modifying the existing SonicOS management access rules (SSH/HTTPS/HTTP).

Potential MITRE ATT&CK TTPs are:

TA0001: Initial Access

TA0003: Persistence

TA0004: Privilege Escalation

TA0005: Defense Evasion

TA0040: Impact

TA0042: Resource Development

T1499: Endpoint Denial of Service

T1499.001: Endpoint Denial of Service: OS Exhaustion Flood

T1574: Hijack Execution Flow

T1588: Obtain Capabilities

T1588.006: Obtain Capabilities: Vulnerabilities

T1190: Exploit Public-Facing Application

Vulnerability Details

Affected Products

References

https://www.sonicwall.com/support/notices/security-notice-critical-unauthenticated-stack-based-buffer-overflow-vulnerability-in-sonicos/220323160744440/

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox

Cyber Horizons 2025

What Last Year’s Attacks Reveal About Today’s Risks

Watch the Webinar on-demand and get a FREE copy of our Cyber Horizons 2025 report.

Our Speakers
Speaker 1

Prateek Bhajanka Global Field CISO & Former Gartner Analyst Hive Pro Inc.

Speaker 2

Ankit Mani Manager Threat Intel HiveForce Labs

Speaker 3

Sreevani Tonipe Senior Threat Researcher HiveForce Labs