CVE-2022-22274CWE-121

A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or…

published March 25, 2022

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.

CVSS
—
EPSS
76%
Percentile
99.5
In the wild
Unconfirmed
What it is

🚨 A stack-based buffer overflow lurking in SonicOS could let attackers crash your firewall or even run their own code! 😱 Think of this vulnerability like a restaurant with an overflowing soup pot. If it spills over, the kitchen gets chaotic, and not only does the soup get ruined, but it can also cause a big mess in the dining area! An attacker could launch a carefully crafted HTTP request to exploit this flaw, causing the firewall to crash or potentially execute arbitrary code. This could lead to a total Denial of Service (DoS), leaving your network exposed and vulnerable while the firewall is down. That’s a recipe for disaster!

Put simply

Think of this vulnerability like a restaurant with an overflowing soup pot. If it spills over, the kitchen gets chaotic, and not only does the soup get ruined, but it can also cause a big mess in the dining area! This vulnerability in SonicOS allows remote unauthenticated attackers to trigger a stack-based buffer overflow by sending a specially crafted HTTP request, which could lead to a crash or code execution on the firewall.

What to do

An attacker could launch a carefully crafted HTTP request to exploit this flaw, causing the firewall to crash or potentially execute arbitrary code. This could lead to a total Denial of Service (DoS), leaving your network exposed and vulnerable while the firewall is down. That’s a recipe for disaster! To protect yourself, ensure you’re running the latest version of SonicOS. Regularly monitor updates from the vendor and consider implementing additional network security measures, such as intrusion detection systems, while you patch up. ⚠️ You can tackle this vulnerability! Stay updated and vigilant, and you'll keep your network secure. You've got this! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.75521 · 99.5th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2022-03-25T23:05Z
EPSS history
Timeline
  • 07 SEP 03:19Z
    EPSS moved 58% → 76%
    epss
  • 06 SEP 03:17Z
    EPSS moved 58% → 76%
    epss
  • 25 MAR 23:05Z
    A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or…
    cvelistv5