9

CVE-2022-1703

Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service (DoS) attack.

Data is provided by the National Vulnerability Database (NVD)
Sonicwall ≫ Sma 210 Firmware Version <= 10.2.1.4-31sv
   Sonicwall ≫ Sma 210 Version-
Sonicwall ≫ Sma 410 Firmware Version <= 10.2.1.4-31sv
   Sonicwall ≫ Sma 410 Version-
Sonicwall ≫ Sma 500v Firmware Version <= 10.2.1.4-31sv
   Sonicwall ≫ Sma 500v Version-
Sonicwall ≫ Sma 210 Firmware Version <= 10.2.0.9-41sv
   Sonicwall ≫ Sma 210 Version-
Sonicwall ≫ Sma 410 Firmware Version <= 10.2.0.9-41sv
   Sonicwall ≫ Sma 410 Version-
Sonicwall ≫ Sma 500v Firmware Version <= 10.2.0.9-41sv
   Sonicwall ≫ Sma 500v Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 3.09% 0.863
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.