Use of Hard-coded Cryptographic Key in SonicWall products - CVE-2022-1701

Vulnerability identifier: #VU63313

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1701

CWE-ID: CWE-321

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to usage of a shared hard-coded encryption key. A local user who can obtain the key can gain access and manipulate sensitive information.

SonicWall SMA 1000
SonicWall SMA 6200
SonicWall SMA 6210
SonicWall SMA 7200
SonicWall SMA 7210
SonicWall SMA 8000v

Install updates from vendor's website.

SonicWall SMA 1000 - update to 12.4.1-02994
SonicWall SMA 6200 - update to 12.4.1-02994
SonicWall SMA 6210 - update to 12.4.1-02994
SonicWall SMA 7200 - update to 12.4.1-02994
SonicWall SMA 7210 - update to 12.4.1-02994
SonicWall SMA 8000v - update to 12.4.1-02994

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009

• Multiple vulnerabilities in SonicWall SSLVPN SMA series