CyberSecBulletin
CVE-2022-47522NVD status: Modified

Ieee 802.11: Authentication Bypass by Spoofing

Published Updated By the CyberSecBulletin desk

CVE-2022-47522 is a high-severity authentication bypass by spoofing vulnerability in Ieee 802.11 from Ieee, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. There is no confirmed exploitation so far. EPSS estimates a 0.89% chance of exploitation within 30 days, higher than 60% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of Ieee 802.11 you run against the affected versions below, and install the vendor's latest release.
  2. Read the advisory on psirt.global.sonicwall.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
IeeeIeee 802.11Not specified in the recordNot stated
SonicWallTz670 FirmwareNot specified in the recordNot stated
SonicWallTz570 FirmwareNot specified in the recordNot stated
SonicWallTz570p FirmwareNot specified in the recordNot stated
SonicWallTz570w FirmwareNot specified in the recordNot stated
SonicWallTz470 FirmwareNot specified in the recordNot stated
SonicWallTz470w FirmwareNot specified in the recordNot stated
SonicWallTz370 FirmwareNot specified in the recordNot stated
SonicWallTz370w FirmwareNot specified in the recordNot stated
SonicWallTz270 FirmwareNot specified in the recordNot stated
SonicWallTz270w FirmwareNot specified in the recordNot stated
SonicWallTz600 FirmwareNot specified in the recordNot stated
SonicWallTz600p FirmwareNot specified in the recordNot stated
SonicWallTz500 FirmwareNot specified in the recordNot stated
SonicWallTz500w FirmwareNot specified in the recordNot stated
SonicWallTz400 FirmwareNot specified in the recordNot stated
SonicWallTz400w FirmwareNot specified in the recordNot stated
SonicWallTz350 FirmwareNot specified in the recordNot stated
SonicWallTz350w FirmwareNot specified in the recordNot stated
SonicWallTz300 FirmwareNot specified in the recordNot stated
SonicWallTz300p FirmwareNot specified in the recordNot stated
SonicWallTz300w FirmwareNot specified in the recordNot stated
SonicWallSoho 250 FirmwareNot specified in the recordNot stated
SonicWallSoho 250w FirmwareNot specified in the recordNot stated
SonicWallSonicwave 231c FirmwareNot specified in the recordNot stated

Version data comes from NVD's product matching; 5 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighNVD
CVSS 3.17.5HighCISA (ADP)

Official description

The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

More Authentication Bypass by Spoofing vulnerabilities (CWE-290)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Technical write-ups (may include proof of concept)

Other references

Recent Authentication Bypass by Spoofing vulnerabilities

Spotted an error? Tell us.