CVE-2022-47522
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-12-18 CVE Reserved
- 2023-04-15 CVE Published
- 2025-02-06 CVE Updated
- 2025-02-06 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-290: Authentication Bypass by Spoofing
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006 | Third Party Advisory |
|
| https://www.freebsd.org/security/advisories/FreeBSD-SA-23:11.wifi.asc | ||
| https://www.wi-fi.org/discover-wi-fi/passpoint | Not Applicable |
| URL | Date | SRC |
|---|---|---|
| https://github.com/toffeenutt/CVE-2022-47522-exploit | 2025-02-11 | |
| https://papers.mathyvanhoef.com/usenix2023-wifi.pdf | 2025-02-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sonicwall Search vendor "Sonicwall" | Tz670 Firmware Search vendor "Sonicwall" for product "Tz670 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz670 Search vendor "Sonicwall" for product "Tz670" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz570 Firmware Search vendor "Sonicwall" for product "Tz570 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz570 Search vendor "Sonicwall" for product "Tz570" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz570p Firmware Search vendor "Sonicwall" for product "Tz570p Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz570p Search vendor "Sonicwall" for product "Tz570p" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz570w Firmware Search vendor "Sonicwall" for product "Tz570w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz570w Search vendor "Sonicwall" for product "Tz570w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz470 Firmware Search vendor "Sonicwall" for product "Tz470 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz470 Search vendor "Sonicwall" for product "Tz470" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz470w Firmware Search vendor "Sonicwall" for product "Tz470w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz470w Search vendor "Sonicwall" for product "Tz470w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz370 Firmware Search vendor "Sonicwall" for product "Tz370 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz370 Search vendor "Sonicwall" for product "Tz370" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz370w Firmware Search vendor "Sonicwall" for product "Tz370w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz370w Search vendor "Sonicwall" for product "Tz370w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz270 Firmware Search vendor "Sonicwall" for product "Tz270 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz270 Search vendor "Sonicwall" for product "Tz270" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz270w Firmware Search vendor "Sonicwall" for product "Tz270w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz270w Search vendor "Sonicwall" for product "Tz270w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz600 Firmware Search vendor "Sonicwall" for product "Tz600 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz600 Search vendor "Sonicwall" for product "Tz600" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz600p Firmware Search vendor "Sonicwall" for product "Tz600p Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz600p Search vendor "Sonicwall" for product "Tz600p" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz500 Firmware Search vendor "Sonicwall" for product "Tz500 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz500 Search vendor "Sonicwall" for product "Tz500" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz500w Firmware Search vendor "Sonicwall" for product "Tz500w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz500w Search vendor "Sonicwall" for product "Tz500w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz400 Firmware Search vendor "Sonicwall" for product "Tz400 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz400 Search vendor "Sonicwall" for product "Tz400" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz400w Firmware Search vendor "Sonicwall" for product "Tz400w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz400w Search vendor "Sonicwall" for product "Tz400w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz350 Firmware Search vendor "Sonicwall" for product "Tz350 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz350 Search vendor "Sonicwall" for product "Tz350" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz350w Firmware Search vendor "Sonicwall" for product "Tz350w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz350w Search vendor "Sonicwall" for product "Tz350w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz300 Firmware Search vendor "Sonicwall" for product "Tz300 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz300 Search vendor "Sonicwall" for product "Tz300" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz300p Firmware Search vendor "Sonicwall" for product "Tz300p Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz300p Search vendor "Sonicwall" for product "Tz300p" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Tz300w Firmware Search vendor "Sonicwall" for product "Tz300w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Tz300w Search vendor "Sonicwall" for product "Tz300w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Soho 250 Firmware Search vendor "Sonicwall" for product "Soho 250 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Soho 250 Search vendor "Sonicwall" for product "Soho 250" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Soho 250w Firmware Search vendor "Sonicwall" for product "Soho 250w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Soho 250w Search vendor "Sonicwall" for product "Soho 250w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Sonicwave 231c Firmware Search vendor "Sonicwall" for product "Sonicwave 231c Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Sonicwave 231c Search vendor "Sonicwall" for product "Sonicwave 231c" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Sonicwave 224w Firmware Search vendor "Sonicwall" for product "Sonicwave 224w Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Sonicwave 224w Search vendor "Sonicwall" for product "Sonicwave 224w" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Sonicwave 432o Firmware Search vendor "Sonicwall" for product "Sonicwave 432o Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Sonicwave 432o Search vendor "Sonicwall" for product "Sonicwave 432o" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Sonicwave 621 Firmware Search vendor "Sonicwall" for product "Sonicwave 621 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Sonicwave 621 Search vendor "Sonicwall" for product "Sonicwave 621" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Sonicwave 641 Firmware Search vendor "Sonicwall" for product "Sonicwave 641 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Sonicwave 641 Search vendor "Sonicwall" for product "Sonicwave 641" | - | - |
Safe
|
| Sonicwall Search vendor "Sonicwall" | Sonicwave 681 Firmware Search vendor "Sonicwall" for product "Sonicwave 681 Firmware" | - | - |
Affected
| in | Sonicwall Search vendor "Sonicwall" | Sonicwave 681 Search vendor "Sonicwall" for product "Sonicwave 681" | - | - |
Safe
|
| Ieee Search vendor "Ieee" | Ieee 802.11 Search vendor "Ieee" for product "Ieee 802.11" | * | - |
Affected
| ||||||