QID 730413

Date Published: 2022-03-31

QID 730413: SonicWall Secure Mobile Access 100 series and Secure Remote Access Command Injection Vulnerability (NWLID-2022-0001)

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions.

CVE-2022-22273:OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products.
Affected version:
SMA100 Series
SonicWall SMA100 9.0.0.9-26sv and earlier versions.BR> QID Detection Logic (Unauthenticated):
This QID detects the vulnerable firmware version from Web interface.

NOTE: We are checking for SMA 100 series affected product only as of now.

Successful exploitation of the vulnerability may leads to Improper neutralization of Special Elements leading to OS Command Injection

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

Vendor has released patch. For more details, please refer to NWLID-2022-0001

Vendor References

SNWLID-2022-0001 - psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0001

CVEs related to QID 730413

CVE-2022-22273 |

Software Advisories

Advisory ID	Software	Component	Link
SNWLID-2022-0001			psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0001

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].