CVE-2022-47522

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-47522
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://papers.mathyvanhoef.com/usenix2023-wifi.pdf Exploit Technical Description Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006 Third Party Advisory
https://www.freebsd.org/security/advisories/FreeBSD-SA-23:11.wifi.asc
https://www.wi-fi.org/discover-wi-fi/passpoint Not Applicable
https://papers.mathyvanhoef.com/usenix2023-wifi.pdf Exploit Technical Description Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006 Third Party Advisory
https://www.freebsd.org/security/advisories/FreeBSD-SA-23:11.wifi.asc
https://www.wi-fi.org/discover-wi-fi/passpoint Not Applicable
Configurations

Configuration 1 (hide)

cpe:2.3:a:ieee:ieee_802.11:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:sonicwall:tz670_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz670:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:sonicwall:tz570_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz570:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:sonicwall:tz570p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz570p:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:sonicwall:tz570w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz570w:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:sonicwall:tz470_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz470:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:sonicwall:tz470w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz470w:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:sonicwall:tz370_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz370:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:sonicwall:tz370w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz370w:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:sonicwall:tz270_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz270:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:sonicwall:tz270w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz270w:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:sonicwall:tz600_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz600:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:sonicwall:tz600p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz600p:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:sonicwall:tz500_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz500:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:sonicwall:tz500w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz500w:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:sonicwall:tz400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz400:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:sonicwall:tz400w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz400w:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:sonicwall:tz350_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz350:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:sonicwall:tz350w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz350w:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:sonicwall:tz300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz300:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:sonicwall:tz300p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz300p:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:sonicwall:tz300w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz300w:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:sonicwall:soho_250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:soho_250:-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:sonicwall:soho_250w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:soho_250w:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
cpe:2.3:o:sonicwall:sonicwave_231c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_231c:-:*:*:*:*:*:*:*

Configuration 26 (hide)

AND
cpe:2.3:o:sonicwall:sonicwave_224w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_224w:-:*:*:*:*:*:*:*

Configuration 27 (hide)

AND
cpe:2.3:o:sonicwall:sonicwave_432o_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_432o:-:*:*:*:*:*:*:*

Configuration 28 (hide)

AND
cpe:2.3:o:sonicwall:sonicwave_621_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_621:-:*:*:*:*:*:*:*

Configuration 29 (hide)

AND
cpe:2.3:o:sonicwall:sonicwave_641_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_641:-:*:*:*:*:*:*:*

Configuration 30 (hide)

AND
cpe:2.3:o:sonicwall:sonicwave_681_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_681:-:*:*:*:*:*:*:*
History

21 Nov 2024, 07:32

Type Values Removed Values Added
References () https://papers.mathyvanhoef.com/usenix2023-wifi.pdf - Exploit, Technical Description, Third Party Advisory () https://papers.mathyvanhoef.com/usenix2023-wifi.pdf - Exploit, Technical Description, Third Party Advisory
References () https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006 - Third Party Advisory () https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006 - Third Party Advisory
References () https://www.freebsd.org/security/advisories/FreeBSD-SA-23:11.wifi.asc - () https://www.freebsd.org/security/advisories/FreeBSD-SA-23:11.wifi.asc -
References () https://www.wi-fi.org/discover-wi-fi/passpoint - Not Applicable () https://www.wi-fi.org/discover-wi-fi/passpoint - Not Applicable

28 Apr 2023, 14:27

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References (MISC) https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006 - (MISC) https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006 - Third Party Advisory
References (MISC) https://www.wi-fi.org/discover-wi-fi/passpoint - (MISC) https://www.wi-fi.org/discover-wi-fi/passpoint - Not Applicable
References (MISC) https://papers.mathyvanhoef.com/usenix2023-wifi.pdf - (MISC) https://papers.mathyvanhoef.com/usenix2023-wifi.pdf - Exploit, Technical Description, Third Party Advisory
CWE CWE-290
CPE cpe:2.3:o:sonicwall:tz600_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz500:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicwave_621_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz400w:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz470:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz370_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz370w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz470_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_641:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_621:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz570:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz400w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicwave_224w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz600:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:soho_250:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz470w:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz370w:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz300p:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicwave_432o_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz600p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz270w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz370:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz500w:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz350w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicwave_681_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz470w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz350_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_432o:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicwave_231c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz300w:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz570p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz350:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz270_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz670_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz300:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_231c:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz270:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz670:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz270w:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz570_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz400:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz570p:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_681:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:soho_250w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:sonicwave_224w:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:soho_250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz600p:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz500w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz300w_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz500_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:soho_250w:-:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz570w:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz300p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicwave_641_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:ieee:ieee_802.11:*:*:*:*:*:*:*:*
cpe:2.3:h:sonicwall:tz350w:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:tz570w_firmware:-:*:*:*:*:*:*:*

15 Apr 2023, 02:25

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-15 02:15

Updated : 2025-02-06 16:15

NVD link : CVE-2022-47522

Mitre link : CVE-2022-47522

CVE.ORG link : CVE-2022-47522

JSON object : View

Products Affected

sonicwall

  • sonicwave_641_firmware
  • tz400w_firmware
  • tz470
  • tz300p
  • tz470w
  • tz400_firmware
  • tz350w_firmware
  • tz400
  • tz500w
  • tz270w_firmware
  • tz570w_firmware
  • tz270
  • sonicwave_681
  • soho_250
  • sonicwave_621
  • tz470w_firmware
  • sonicwave_621_firmware
  • tz570w
  • tz300_firmware
  • tz500w_firmware
  • tz300w
  • tz270_firmware
  • soho_250w
  • tz370_firmware
  • tz350
  • tz570_firmware
  • tz670_firmware
  • tz400w
  • tz300p_firmware
  • soho_250_firmware
  • tz370w
  • tz600p
  • tz570p_firmware
  • sonicwave_641
  • tz570
  • sonicwave_681_firmware
  • tz370
  • tz500
  • tz300w_firmware
  • tz350_firmware
  • tz470_firmware
  • tz300
  • tz500_firmware
  • sonicwave_231c_firmware
  • sonicwave_224w_firmware
  • tz600_firmware
  • tz670
  • sonicwave_432o_firmware
  • sonicwave_432o
  • tz270w
  • tz370w_firmware
  • tz600p_firmware
  • tz570p
  • tz350w
  • sonicwave_231c
  • sonicwave_224w
  • soho_250w_firmware
  • tz600

ieee

  • ieee_802.11
CWE
CWE-290

Authentication Bypass by Spoofing