Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-22278: A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an atta...

CVE-2022-22278 · published 4 years ago

Summary

A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack

What to do

Update sonicwall tz300p_firmware to version 7.0.1 or later.
Update sonicwall tz300w_firmware to version 7.0.1 or later.
Update sonicwall tz350_firmware to version 7.0.1 or later.
Update sonicwall tz350w_firmware to version 7.0.1 or later.
Update sonicwall nssp_10700_firmware to version 7.0.1.0 or later.
Update sonicwall nssp_11700_firmware to version 7.0.1.0 or later.
Update sonicwall nssp_12400_firmware to version 7.0.1.0 or later.
Update sonicwall nssp_12800_firmware to version 7.0.1.0 or later.
Update sonicwall nssp_13700_firmware to version 7.0.1.0 or later.
Update sonicwall nssp_15700_firmware to version 7.0.1.0 or later.
Update sonicwall tz370_firmware to version 7.0.1 or later.
Update sonicwall tz370w_firmware to version 7.0.1 or later.
Update sonicwall tz400_firmware to version 7.0.1 or later.
Update sonicwall nsv_10_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_100_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_1600_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_200_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_25_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_270_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_300_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_400_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_470_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_50_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_800_firmware to version 7.0.1.0 or later.
Update sonicwall nsv_870_firmware to version 7.0.1.0 or later.
Update sonicwall tz400w_firmware to version 7.0.1 or later.
Update sonicwall tz470_firmware to version 7.0.1 or later.
Update sonicwall tz470w_firmware to version 7.0.1 or later.
Update sonicwall tz500_firmware to version 7.0.1 or later.
Update sonicwall nsa_2650_firmware to version 7.0.1 or later.
Update sonicwall nsa_2700_firmware to version 7.0.1 or later.
Update sonicwall nsa_3650_firmware to version 7.0.1 or later.
Update sonicwall nsa_3700_firmware to version 7.0.1 or later.
Update sonicwall nsa_4650_firmware to version 7.0.1 or later.
Update sonicwall nsa_4700_firmware to version 7.0.1 or later.
Update sonicwall nsa_5650_firmware to version 7.0.1 or later.
Update sonicwall nsa_5700_firmware to version 7.0.1 or later.
Update sonicwall nsa_6650_firmware to version 7.0.1 or later.
Update sonicwall nsa_6700_firmware to version 7.0.1 or later.
Update sonicwall nsa_9250_firmware to version 7.0.1 or later.
Update sonicwall nsa_9450_firmware to version 7.0.1 or later.
Update sonicwall nsa_9650_firmware to version 7.0.1 or later.
Update sonicwall tz500w_firmware to version 7.0.1 or later.
Update sonicwall tz570_firmware to version 7.0.1 or later.
Update sonicwall tz570p_firmware to version 7.0.1 or later.
Update sonicwall tz570w_firmware to version 7.0.1 or later.
Update sonicwall tz600_firmware to version 7.0.1 or later.
Update sonicwall tz600p_firmware to version 7.0.1 or later.
Update sonicwall tz670_firmware to version 7.0.1 or later.

Affected software

Vendor	Product	Affected versions
sonicwall	tz300p_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz300p_firmware::::::::`
sonicwall	tz300w_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz300w_firmware::::::::`
sonicwall	tz350_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz350_firmware::::::::`
sonicwall	tz350w_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz350w_firmware::::::::`
sonicwall	nssp_10700_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nssp_10700_firmware::::::::`
sonicwall	nssp_11700_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nssp_11700_firmware::::::::`
sonicwall	nssp_12400_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nssp_12400_firmware::::::::`
sonicwall	nssp_12800_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nssp_12800_firmware::::::::`
sonicwall	nssp_13700_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nssp_13700_firmware::::::::`
sonicwall	nssp_15700_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nssp_15700_firmware::::::::`
sonicwall	tz370_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz370_firmware::::::::`
sonicwall	tz370w_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz370w_firmware::::::::`
sonicwall	tz400_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz400_firmware::::::::`
sonicwall	nsv_10_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_10_firmware::::::::`
sonicwall	nsv_100_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_100_firmware::::::::`
sonicwall	nsv_1600_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_1600_firmware::::::::`
sonicwall	nsv_200_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_200_firmware::::::::`
sonicwall	nsv_25_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_25_firmware::::::::`
sonicwall	nsv_270_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_270_firmware::::::::`
sonicwall	nsv_300_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_300_firmware::::::::`
sonicwall	nsv_400_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_400_firmware::::::::`
sonicwall	nsv_470_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_470_firmware::::::::`
sonicwall	nsv_50_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_50_firmware::::::::`
sonicwall	nsv_800_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_800_firmware::::::::`
sonicwall	nsv_870_firmware	< 7.0.1.0 `cpe:2.3:o:sonicwall:nsv_870_firmware::::::::`
sonicwall	tz400w_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz400w_firmware::::::::`
sonicwall	tz470_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz470_firmware::::::::`
sonicwall	tz470w_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz470w_firmware::::::::`
sonicwall	tz500_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz500_firmware::::::::`
sonicwall	nsa_2650_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_2650_firmware::::::::`
sonicwall	nsa_2700_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_2700_firmware::::::::`
sonicwall	nsa_3650_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_3650_firmware::::::::`
sonicwall	nsa_3700_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_3700_firmware::::::::`
sonicwall	nsa_4650_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_4650_firmware::::::::`
sonicwall	nsa_4700_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_4700_firmware::::::::`
sonicwall	nsa_5650_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_5650_firmware::::::::`
sonicwall	nsa_5700_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_5700_firmware::::::::`
sonicwall	nsa_6650_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_6650_firmware::::::::`
sonicwall	nsa_6700_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_6700_firmware::::::::`
sonicwall	nsa_9250_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_9250_firmware::::::::`
sonicwall	nsa_9450_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_9450_firmware::::::::`
sonicwall	nsa_9650_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:nsa_9650_firmware::::::::`
sonicwall	tz500w_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz500w_firmware::::::::`
sonicwall	tz570_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz570_firmware::::::::`
sonicwall	tz570p_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz570p_firmware::::::::`
sonicwall	tz570w_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz570w_firmware::::::::`
sonicwall	tz600_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz600_firmware::::::::`
sonicwall	tz600p_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz600p_firmware::::::::`
sonicwall	tz670_firmware	< 7.0.1 `cpe:2.3:o:sonicwall:tz670_firmware::::::::`

Original advisory text

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published27 Apr 2022

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-22278 · NVD

Track software like this

Free during beta