by Kastro
Paper/Archive/CVE-2022-22273

CVE-2022-22273

SonicWall SonicWall SRA/SMA100 — Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.0.800 × 2016.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions

Affected

ProductAffectedFixed inSource
SonicWall SRA/SMA100SRA Series 9.0.0.5-19sv and earlier versions.–CNA
SonicWall SRA/SMA100SMA100 Series 9.0.0.9-26sv and earlier versions.–CNA
sma_100≤ 9.0.0.9-26sv–CISA-ADP
sra≤ 9.0.0.5-19sv–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpsirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0001