CVE-2022-47522
high-risk
Published 2023-04-15
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
Do I need to act?
!
17.6% chance of exploitation in next 30 days
EPSS score — higher than 82% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
ADJACENT_NETWORK
/ HIGH complexity
Affected Products (20)
Ieee 802.11
Tz670 Firmware
Tz570 Firmware
Tz570P Firmware
Tz570W Firmware
Tz470 Firmware
Tz470W Firmware
Tz370 Firmware
Tz370W Firmware
Tz600 Firmware
Tz600P Firmware
Tz500 Firmware
Tz500W Firmware
Tz400 Firmware
Tz400W Firmware
Tz350 Firmware
Tz350W Firmware
References (8)
Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006
Not Applicable
https://www.wi-fi.org/discover-wi-fi/passpoint
Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0006
Not Applicable
https://www.wi-fi.org/discover-wi-fi/passpoint
55
/ 100
high-risk
Severity
20/34 · Moderate
Exploitability
13/34 · Low
Exposure
22/34 · High