CVE-2022-2323

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-29 · updated 2026-06-17
Weakness: CWE-77

Description

Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions

Affected products

SonicWall Sws12-10Fpoe Firmware: before 1.2.0.0-3 — fixed in 1.2.0.0-3
SonicWall Sws12-8 Firmware: before 1.2.0.0-3 — fixed in 1.2.0.0-3
SonicWall Sws12-8Poe Firmware: before 1.2.0.0-3 — fixed in 1.2.0.0-3
SonicWall Sws14-24 Firmware: before 1.2.0.0-3 — fixed in 1.2.0.0-3
SonicWall Sws14-24Fpoe Firmware: before 1.2.0.0-3 — fixed in 1.2.0.0-3
SonicWall Sws14-48 Firmware: before 1.2.0.0-3 — fixed in 1.2.0.0-3
SonicWall Sws14-48Fpoe Firmware: before 1.2.0.0-3 — fixed in 1.2.0.0-3

How to fix

Upgrade to a fixed version: SonicWall Sws12-10Fpoe Firmware 1.2.0.0-3; SonicWall Sws12-8 Firmware 1.2.0.0-3; SonicWall Sws12-8Poe Firmware 1.2.0.0-3; SonicWall Sws14-24 Firmware 1.2.0.0-3; SonicWall Sws14-24Fpoe Firmware 1.2.0.0-3; SonicWall Sws14-48 Firmware 1.2.0.0-3; SonicWall Sws14-48Fpoe Firmware 1.2.0.0-3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-2323 or the next vulnerability affects your stack