CVE-2022-22279

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-13 · updated 2026-06-17
Weakness: CWE-23

Description

A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions

Affected products

SonicWall Sma 210 Firmware: before 9.0.0.10-28sv — fixed in 9.0.0.10-28sv
SonicWall Sma 410 Firmware: before 9.0.0.10-28sv — fixed in 9.0.0.10-28sv
SonicWall Sma 500V Firmware: before 9.0.0.10-28sv — fixed in 9.0.0.10-28sv
SonicWall Sra 1200 Firmware: through 9.0.0.5-19sv
SonicWall Sra 4200 Firmware: through 9.0.0.5-19sv

How to fix

Upgrade to a fixed version: SonicWall Sma 210 Firmware 9.0.0.10-28sv; SonicWall Sma 410 Firmware 9.0.0.10-28sv; SonicWall Sma 500V Firmware 9.0.0.10-28sv. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22279 or the next vulnerability affects your stack