CVE-2022-22278
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.94%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.94% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- sonicwall/tz300p firmware · sonicwall/tz300w firmware · sonicwall/tz350 firmware · sonicwall/tz350w firmware · sonicwall/nssp 10700 firmware · sonicwall/nssp 11700 firmware · sonicwall/nssp 12400 firmware · sonicwall/nssp 12800 firmware · sonicwall/nssp 13700 firmware · sonicwall/nssp 15700 firmware · sonicwall/tz370 firmware · sonicwall/tz370w firmware · sonicwall/tz400 firmware · sonicwall/nsv 10 firmware · sonicwall/nsv 100 firmware · sonicwall/nsv 1600 firmware · sonicwall/nsv 200 firmware · sonicwall/nsv 25 firmware · sonicwall/nsv 270 firmware · sonicwall/nsv 300 firmware · +29 more
- Source
- PSIRT@sonicwall.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.