CVE-2022-1701 Hardcoded credentials in SonicWall SMA1000
Attackers can decrypt stored data using a hard-coded key, exposing sensitive information and bypassing security controls on SonicWall SMA1000 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1701?
CVE-2022-1701 is a high-severity vulnerability in SonicWall SMA1000, published on 13 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.
Which versions are affected by CVE-2022-1701?
It affects 5 products.
Products include Sonicwall Sma 6200 Firmware, Sonicwall Sma 6210 Firmware, Sonicwall Sma 7200 Firmware, Sonicwall Sma 7210 Firmware, Sonicwall Sma 8000v Firmware.
How do I fix CVE-2022-1701?
No fix has been published for CVE-2022-1701 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1701 being exploited?
There is no known exploitation of CVE-2022-1701 in the wild and no public exploit code.
Other vulnerabilities in SonicWall SMA1000
Sources
Also known as GHSA-rxgp-8c89-84pf.