What’s Vulnerable › Vulnerabilities
CVE-2022-47522
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-04-15 · updated 2026-06-17
- Weakness: CWE-290
Description
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
Affected products
- Ieee 802.11: all versions
- SonicWall Soho 250 Firmware: all versions
- SonicWall Soho 250W Firmware: all versions
- SonicWall Sonicwave 224W Firmware: all versions
- SonicWall Sonicwave 231C Firmware: all versions
- SonicWall Sonicwave 432O Firmware: all versions
- SonicWall Sonicwave 621 Firmware: all versions
- SonicWall Sonicwave 641 Firmware: all versions
- SonicWall Sonicwave 681 Firmware: all versions
- SonicWall Tz270 Firmware: all versions
- SonicWall Tz270W Firmware: all versions
- SonicWall Tz300 Firmware: all versions
- SonicWall Tz300P Firmware: all versions
- SonicWall Tz300W Firmware: all versions
- SonicWall Tz350 Firmware: all versions
- SonicWall Tz350W Firmware: all versions
- SonicWall Tz370 Firmware: all versions
- SonicWall Tz370W Firmware: all versions
- SonicWall Tz400 Firmware: all versions
- SonicWall Tz400W Firmware: all versions
- SonicWall Tz470 Firmware: all versions
- SonicWall Tz470W Firmware: all versions
- SonicWall Tz500 Firmware: all versions
- SonicWall Tz500W Firmware: all versions
- SonicWall Tz570 Firmware: all versions
- SonicWall Tz570P Firmware: all versions
- SonicWall Tz570W Firmware: all versions
- SonicWall Tz600 Firmware: all versions
- SonicWall Tz600P Firmware: all versions
- SonicWall Tz670 Firmware: all versions
References
- https://papers.mathyvanhoef.com/usenix2023-wifi.pdf
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006
- https://www.freebsd.org/security/advisories/FreeBSD-SA-23:11.wifi.asc
- https://www.wi-fi.org/discover-wi-fi/passpoint
- https://papers.mathyvanhoef.com/usenix2023-wifi.pdf
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006
- https://www.freebsd.org/security/advisories/FreeBSD-SA-23:11.wifi.asc
- https://www.wi-fi.org/discover-wi-fi/passpoint
Get alerted when CVE-2022-47522 or the next vulnerability affects your stack