SonicWall urges customers to fix SMA 1000 vulnerabilities

SonicWall warns customers to address several high-risk security flaws impacting its Secure Mobile Access (SMA) 1000 Series line of products.

SonicWall urges customers to address several high-risk security vulnerabilities affecting its Secure Mobile Access (SMA) 1000 Series line of products. An attacker can exploit the vulnerabilities to bypass authorization and, potentially, compromise vulnerable devices.

The first issue, tracked as CVE-2022-22282, in an unauthenticated access control bypass flaw, it affects SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions. The flaw was rated high severity.

“SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability.” reads the description for this issue.

The vendor also addressed a hard-coded cryptographic key and an open redirect issue, the two flaws are rated as medium severity.

The SonicWall Product Security & Incident Response Team (PSIRT) said that it is now aware of attacks in the wild exploiting any of the above flaws. The company pointed out that there are no temporary mitigations.

“There are no temporary mitigations. SonicWall urges impacted customers to implement applicable patches as soon as possible.” continues the report.

The flaws does not impact SMA 1000 series running versions earlier than 12.4.0.

Below is the list of impacted platforms:

SonicWall strongly urges that organizations using the SMA 1000 series

Pierluigi Paganini

(SecurityAffairs – hacking, SMA)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.