CVE-2022-22274

What it actually does

CVE-2022-22274 is a stack-based buffer overflow in SonicWall SonicOS reachable through crafted HTTP requests. Because the vulnerable code path is network-accessible and does not require authentication or user interaction, a remote attacker can send malformed HTTP input to corrupt stack memory in the firewall process. The expected impact is denial of service through process or appliance crash/restart; depending on platform protections, firmware build, memory layout, and exploit reliability, the same primitive may potentially allow arbitrary code execution with the privileges of the affected service, leading to full compromise of the firewall.

Why it matters to the business

Affected SonicWall firewalls sit at the network perimeter, so exploitation can disrupt internet/VPN connectivity, interrupt branch or data-center traffic, and degrade security enforcement. If code execution is achieved, an attacker could gain control of a security gateway, alter policies, intercept or redirect traffic, pivot into internal networks, or establish persistent access. The CVSS score is critical and EPSS is elevated, meaning exposed management or HTTP/HTTPS interfaces should be treated as high-priority risk even though this CVE is not currently listed in CISA KEV and no ransomware-specific KEV association is reported.

How an attack unfolds

An attacker first identifies a SonicWall SonicOS appliance with an exposed HTTP/HTTPS interface on an affected hardware, virtual, or NSsp/NSA/TZ/NSv platform. They then send a specially crafted unauthenticated HTTP request designed to exceed the size expected by a vulnerable stack buffer. If the overwrite is not controlled reliably, the firewall service or appliance may crash, causing denial of service. A more advanced exploit would shape the overflow to control execution flow, bypass available memory protections, and run attacker-controlled code within the SonicOS process context. Successful code execution on a perimeter firewall could then be used to modify configuration, disable protections, create unauthorized access paths, capture traffic, or pivot toward internal systems.

How to fix it

Upgrade affected SonicWall SonicOS and SonicOSv appliances to a vendor-fixed release for the specific platform. Because no exact fixed versions were provided in the input, administrators should consult SonicWall’s official advisory for CVE-2022-22274 and apply the recommended patched firmware for NSA 2700/3700/4700/5700/6700, NSsp 10700/11700/13700/15700, NSv 10/270/470/870, TZ270/TZ370/TZ470/TZ570/TZ670 variants, SonicOS, and SonicOSv. Until patched, restrict HTTP/HTTPS management access to trusted administrative networks or VPN-only paths, disable WAN-side management where not required, enforce management ACLs, and monitor for crashes or anomalous HTTP requests. If exploitation is suspected, treat the firewall as a potentially compromised perimeter device: preserve logs, review configuration for unauthorized changes, rotate administrative credentials and shared secrets, and consider reimaging/replacing the appliance with known-good firmware.

How to confirm the fix worked

Confirm the appliance model and SonicOS/SonicOSv firmware version against the SonicWall advisory and verify it is at or above the fixed release for that platform. Validate that management access is not exposed to untrusted networks by reviewing WAN management settings, access rules, NAT rules, and external scan results. After patching, confirm the device reports the expected firmware version after reboot and that security services and VPN functions remain operational. Use a safe vulnerability scanner or authenticated configuration audit rather than attempting exploit payloads in production. Review system uptime, crash/reboot history, and logs before and after remediation to confirm there are no recurring HTTP-triggered faults.

Typical attack path

1. Scan the internet or target ranges for exposed SonicWall SonicOS HTTP/HTTPS management or service interfaces.
2. Fingerprint the appliance model or SonicOS version where possible to determine whether it may be affected.
3. Send crafted unauthenticated HTTP requests containing oversized or malformed fields that trigger the stack-based buffer overflow.
4. Cause the SonicOS process or appliance to crash, restart, or become unavailable, resulting in denial of service.
5. If exploit development is successful, manipulate the stack overwrite to gain code execution on the firewall.
6. Use compromised firewall control to alter access rules, stage persistence, inspect traffic, or pivot into protected networks.

How to detect it

Look for evidence of unauthenticated HTTP/HTTPS requests to SonicWall management or service interfaces immediately preceding firewall process crashes, appliance reboots, failovers, or loss of management responsiveness. Useful sources include SonicWall system/event logs, management access logs if available, high availability/failover logs, VPN and administrator audit logs, upstream reverse proxy or load balancer logs if the interface is proxied, NetFlow/firewall telemetry, IDS/IPS alerts, and external perimeter scan records. Focus on oversized or malformed HTTP headers, unusual methods, repeated requests from the same source, requests to management endpoints from untrusted IPs, and timing correlation between suspicious HTTP traffic and watchdog resets or unexpected reboots. For possible code execution, look for unauthorized administrator logins, new or modified local users, changed access rules/NAT/VPN settings, disabled security services, unexpected firmware/configuration changes, unexplained outbound connections from the firewall, or configuration exports that were not initiated by administrators. There are no widely standardized public payload strings for this CVE in the supplied data, so detection should emphasize behavioral correlation between suspicious HTTP traffic and SonicOS instability or configuration changes.

• HTTP requests to SonicWall management interface immediately followed by firewall reboot or service restart
• Unexpected SonicOS appliance reboot
• Unexpected SonicOS high-availability failover
• SonicOS management interface crash
• Repeated unauthenticated HTTP requests to / from a single external source
• Oversized HTTP headers sent to SonicWall management interface
• Malformed HTTP request sent to SonicWall management interface
• Unauthorized SonicWall administrator login
• Unexpected SonicWall access rule change
• Unexpected SonicWall NAT policy change
• Unexpected SonicWall VPN configuration change
• Unexpected SonicWall firmware or configuration export
• Disabled SonicWall security services

What your security team should do

• Prioritize patching any SonicWall SonicOS/SonicOSv appliance with internet-exposed HTTP/HTTPS management or service interfaces.
• Immediately disable or restrict WAN-side management access to known trusted administrative IP ranges until all affected appliances are upgraded.
• Inventory all SonicWall NSA, NSsp, NSv, TZ, SonicOS, and SonicOSv deployments and map each to the vendor-fixed firmware release.
• Search historical firewall logs, system logs, and network telemetry for unexplained HTTP requests followed by service crashes, appliance reboots, or management-plane instability.
• If suspicious activity is found, perform incident response on the firewall: export and preserve logs, review administrator accounts and configuration changes, rotate credentials, and rebuild or reimage from trusted firmware if compromise cannot be ruled out.
• Add monitoring for abnormal volumes of requests to firewall management endpoints and for repeated crash/restart events.
• Because perimeter firewall compromise can enable downstream intrusion, review adjacent authentication, VPN, and internal access logs for activity originating from or routed through the device after any suspected exploitation window.