CVE-2022-22273

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-17 · updated 2026-06-17
Weakness: CWE-78

Description

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions

Affected products

SonicWall Sma 200 Firmware: through 9.0.0.9-26sv
SonicWall Sma 210 Firmware: through 9.0.0.9-26sv
SonicWall Sma 400 Firmware: through 9.0.0.9-26sv
SonicWall Sma 410 Firmware: through 9.0.0.9-26sv
SonicWall Sma 500V Firmware: through 9.0.0.9-26sv
SonicWall Sra 1200 Firmware: through 9.0.0.5-19sv
SonicWall Sra 1600 Firmware: through 9.0.0.5-19sv
SonicWall Sra 4200 Firmware: through 9.0.0.5-19sv
SonicWall Sra 4600 Firmware: through 9.0.0.5-19sv

References

Get alerted when CVE-2022-22273 or the next vulnerability affects your stack