Login Request a demo
High severity · published Apr 27, 2022
CVE-2022-22278
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource…
7.5
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
N2
Nsa 2650 Firmware · Sonicwall
before 7.0.1 · source: NVD
N2
Nsa 2700 Firmware · Sonicwall
before 7.0.1 · source: NVD
N3
Nsa 3650 Firmware · Sonicwall
before 7.0.1 · source: NVD
N3
Nsa 3700 Firmware · Sonicwall
before 7.0.1 · source: NVD
N4
Nsa 4650 Firmware · Sonicwall
before 7.0.1 · source: NVD
N4
Nsa 4700 Firmware · Sonicwall
before 7.0.1 · source: NVD
N5
Nsa 5650 Firmware · Sonicwall
before 7.0.1 · source: NVD
N5
Nsa 5700 Firmware · Sonicwall
before 7.0.1 · source: NVD
N6
Nsa 6650 Firmware · Sonicwall
before 7.0.1 · source: NVD
N6
Nsa 6700 Firmware · Sonicwall
before 7.0.1 · source: NVD
N9
Nsa 9250 Firmware · Sonicwall
before 7.0.1 · source: NVD
N9
Nsa 9450 Firmware · Sonicwall
before 7.0.1 · source: NVD
Affected product
N2
Nsa 2650 Firmware
Sonicwall
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-22278
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-22278
Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
More from Nsa 2650 Firmware
5.3
CVE-2022-22277
A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext
5.3
CVE-2022-22276
A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user