More than 178,000 SonicWall firewalls are vulnerable to Denial of Service (DoS) and Remote Code Execution (RCE) attacks due to two vulnerabilities. The discovery was made by Bishop Fox security experts.
According to Bishop Fox, SonicWall’s more than 178,000 next-generation Series 6 and 7 firewalls are affected by two critical vulnerabilities: CVE-2022-22274 and CVE-2023-0656. Since these firewalls are connected to the Internet, exploitation is possible.
However, attackers must actually know what firmware is running on the SonicWall firewall, since a patch is already available. The researchers state that a denial-of-service attack is realistically possible, but remote code execution would still have some hurdles to overcome.
Both vulnerabilities involve unauthenticated DoS vulnerabilities. In addition, CV-2022-22274 also has the potential for remote running of arbitrary code or an RCE attack.
Different attacks possible
Both vulnerabilities provide the same attack functionality, but differ in that they can be exploited via different HTTP URI paths. This makes the attack surface extremely large, the researchers conclude.
In addition, the vulnerabilities are critical because if hackers cannot run code on an attacked firewall, they can still exploit the vulnerabilities to activate maintenance mode, requiring administrator intervention.
CVE-2022-22274 PoC available
Although SonicWall security experts indicate that they have not yet encountered an exploit of these two vulnerabilities, a proof-of-concept (PoC) for the CVE-2022-22274 vulnerability has already been developed. This PoC was developed by SDD Labs and is now online.
Companies that have SonicWall’s affected Series 6 and 7 firewalls are urged to ensure that the management interface is not connected to the public Internet. They should also upgrade their appliances with the latest firmware as soon as possible.
Also read: SonicWall expands SASE portfolio with acquisition of Banyan Security