Security News > 2022 > March > Critical SonicWall firewall patch not released for all devices
Security hardware manufacturer SonicWall has fixed a critical vulnerability in the SonicOS security operating system that allows denial of service attacks and could lead to remote code execution.
The security flaw is a stack-based buffer overflow weakness with a 9.4 CVSS severity score and impacting multiple SonicWall firewalls.
The SonicWall Product Security Incident Response Team says there are no reports of public proof-of-concept exploits, and it found no evidence of exploitation in attacks.
"SonicWall strongly urges organizations using impacted SonicWall firewalls listed below to follow the provided guidance," the company said in a security advisory published on Friday.
The only affected firewall still waiting for a patch against CVE-2022-22274 is the NSsp 15700 enterprise-class high-speed firewall.
The SonicWall support website provides customers with more information on how to restrict admin access and tips on when to allow access to the firewalls' web management interface.
News URL
Related news
- SonicWall firewall exploit lets hackers hijack VPN sessions, patch now (source)
- SonicWall firewalls now under attack: Patch ASAP or risk intrusion via your SSL VPN (source)
- Netgear warns users to patch critical WiFi router vulnerabilities (source)
- SonicWall firewall bug leveraged in attacks after PoC exploit release (source)
- Choose your own Patch Tuesday adventure: Start with six zero day fixes, or six critical flaws (source)
- Critical Veeam Backup & Replication RCE vulnerability fixed, patch ASAP! (CVE-2025-23120) (source)
- CrushFTP: Patch critical vulnerability ASAP! (CVE-2025-2825) (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-03-25 | CVE-2022-22274 | Out-of-bounds Write vulnerability in Sonicwall Sonicos A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall. | 9.8 |