CVE-2022-22282CWE-284

SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an…

published May 13, 2022

CVSS
—
EPSS
8%
Percentile
94.6
In the wild
Unconfirmed
What it is

⚠️ A sneaky oversight lets unauthorized users sneak past the gates of your SonicWall SMA1000 series! Think of this vulnerability like a hotel with a concierge who never checks IDs; anyone can stroll right past and access restricted floors without breaking a sweat. 🚪 The implications here are concerning—an unauthorized actor could potentially access sensitive resources without any authentication check, risking the confidentiality and integrity of your data. This flaw could lead to a breach that leaves your organization vulnerable to data exposure and unauthorized actions.

Put simply

Think of this vulnerability like a hotel with a concierge who never checks IDs; anyone can stroll right past and access restricted floors without breaking a sweat. 🚪 This Improper Access Control vulnerability arises due to SonicWall SMA1000 series firmware incorrectly restricting access over HTTP connections, allowing an unauthorized user to gain access to restricted resources.

What to do

The implications here are concerning—an unauthorized actor could potentially access sensitive resources without any authentication check, risking the confidentiality and integrity of your data. This flaw could lead to a breach that leaves your organization vulnerable to data exposure and unauthorized actions. To safeguard your system, be sure to update your SonicWall SMA1000 series firmware to the latest version that addresses this flaw. Regularly audit your access controls to ensure they are enforcing proper restrictions. You've got this! Follow these steps to shore up your defenses and keep unauthorized access at bay. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07770 · 94.6th percentile
Weakness
CWE-284 · Improper Access Control
Published
2022-05-13T19:40Z
EPSS history
Timeline
  • 13 MAY 19:40Z
    SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an…
    cvelistv5