CVE-2022-2323

Published: Jul 29, 2022Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions

Affected (7)

Products: Sonicwall: Sws12 10fpoe Firmware, Sws12 8 Firmware, Sws12 8poe Firmware, Sws14 24 Firmware, Sws14 24fpoe Firmware, Sws14 48 Firmware, Sws14 48fpoe Firmware

Sonicwall

7 products

Sws12 10fpoe Firmware

Sws12 8 Firmware

Sws12 8poe Firmware

Sws14 24 Firmware

Sws14 24fpoe Firmware

Sws14 48 Firmware

Sws14 48fpoe Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sws12 10fpoe Firmware	Before 1.2.0.0-3

Running on/with	Platform Versions
Sonicwall Sws12 10fpoe	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sws12 8 Firmware	Before 1.2.0.0-3

Running on/with	Platform Versions
Sonicwall Sws12 8	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sws12 8poe Firmware	Before 1.2.0.0-3

Running on/with	Platform Versions
Sonicwall Sws12 8poe	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sws14 24 Firmware	Before 1.2.0.0-3

Running on/with	Platform Versions
Sonicwall Sws14 24	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sws14 24fpoe Firmware	Before 1.2.0.0-3

Running on/with	Platform Versions
Sonicwall Sws14 24fpoe	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sws14 48 Firmware	Before 1.2.0.0-3

Running on/with	Platform Versions
Sonicwall Sws14 48	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sws14 48fpoe Firmware	Before 1.2.0.0-3

Running on/with	Platform Versions
Sonicwall Sws14 48fpoe	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0013

Source: PSIRT@sonicwall.com

Vendor Advisory

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0013

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.