CVE-2022-22275
📋 TL;DR
This vulnerability in SonicWall firewalls allows attackers to bypass security policies by sending TCP traffic through HTTP/S channels from WAN to DMZ before TCP handshake completion. This could lead to denial of service attacks against vulnerable hosts. Organizations using affected SonicWall firewall products are at risk.
💻 Affected Systems
- SonicWall firewalls
📦 What is this software?
Sonicos by Sonicwall
Sonicos by Sonicwall
Sonicos by Sonicwall
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of firewall security policies allowing direct DoS attacks against internal systems, potentially taking critical services offline.
Likely Case
Limited DoS attacks against specific vulnerable hosts behind the firewall, causing service disruption.
If Mitigated
Minimal impact with proper network segmentation and additional security controls in place.
🎯 Exploit Status
Exploitation requires network access to the firewall's WAN interface
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
Restart Required: Yes
Instructions:
1. Access SonicWall firewall management interface. 2. Check current firmware version. 3. Download and apply the latest firmware patch from SonicWall support portal. 4. Reboot the firewall after patch installation.
🔧 Temporary Workarounds
Restrict WAN to DMZ HTTP/S traffic
allTemporarily block or restrict HTTP/S traffic from WAN to DMZ zones
Implement additional network segmentation
allAdd additional firewall rules or network segmentation between DMZ and internal networks
🧯 If You Can't Patch
- Implement strict network access controls between WAN and DMZ zones
- Deploy additional intrusion prevention systems to monitor for DoS attempts
🔍 How to Verify
Check if Vulnerable:
Check firewall firmware version against vendor advisory and verify HTTP/S traffic policies from WAN to DMZCheck Version:
Check via SonicWall management interface or CLI: show versionVerify Fix Applied:
Verify firmware version is updated to patched version and test HTTP/S traffic handling📡 Detection & Monitoring
Log Indicators:
- Unusual TCP handshake patterns
- HTTP/S traffic bypassing expected policies
- Increased connection attempts to DMZ hosts
Network Indicators:
- Abnormal TCP SYN packets to DMZ hosts
- HTTP/S traffic patterns inconsistent with policies
SIEM Query:
firewall_logs source_zone="WAN" dest_zone="DMZ" protocol="TCP" (port=80 OR port=443) action="allow" | stats count by src_ip