CVE-2022-22282 Missing authorization in SonicWall SMA1000

Critical 9.8 Published 13 May 2022 Updated 3 Aug 2024

Unauthorized actors can access restricted resources on SonicWall SMA1000 devices due to improper access control restrictions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-22282?

CVE-2022-22282 is a critical missing authorization vulnerability in SonicWall SMA1000, published on 13 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability.

Weakness: CWE-284

Which versions are affected by CVE-2022-22282?

It affects 5 products.

Products include Sonicwall Sma 6200 Firmware, Sonicwall Sma 6210 Firmware, Sonicwall Sma 7200 Firmware, Sonicwall Sma 7210 Firmware, Sonicwall Sma 8000v Firmware.

How do I fix CVE-2022-22282?

No fix has been published for CVE-2022-22282 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-22282 being exploited?

There is no known exploitation of CVE-2022-22282 in the wild and no public exploit code.

Sources

Also known as GHSA-8xpw-m3x3-rq75.