CVE-2022-22278
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP...
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
- Record
CVE-2022-22278- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE List No score
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
- Record
CVE-2022-22278- Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2022-27425 No score
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
- Record
EUVD-2022-27425- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fpfj-wp86-qmrq
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP...
A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack
- Record
GHSA-fpfj-wp86-qmrq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Affected products
- sonicwall sonicos
- sonicwall nsa 2650 firmware
- sonicwall nsa 2700 firmware
- sonicwall nsa 3650 firmware
- sonicwall nsa 3700 firmware
- sonicwall nsa 4650 firmware
- sonicwall nsa 4700 firmware
- sonicwall nsa 5650 firmware
- sonicwall nsa 5700 firmware
- sonicwall nsa 6650 firmware
- sonicwall nsa 6700 firmware
- sonicwall nsa 9250 firmware
Show 38 moreShow less
- sonicwall nsa 9450 firmware
- sonicwall nsa 9650 firmware
- sonicwall nssp 10700 firmware
- sonicwall nssp 11700 firmware
- sonicwall nssp 12400 firmware
- sonicwall nssp 12800 firmware
- sonicwall nssp 13700 firmware
- sonicwall nssp 15700 firmware
- sonicwall nsv 100 firmware
- sonicwall nsv 10 firmware
- sonicwall nsv 1600 firmware
- sonicwall nsv 200 firmware
- sonicwall nsv 25 firmware
- sonicwall nsv 270 firmware
- sonicwall nsv 300 firmware
- sonicwall nsv 400 firmware
- sonicwall nsv 470 firmware
- sonicwall nsv 50 firmware
- sonicwall nsv 800 firmware
- sonicwall nsv 870 firmware
- sonicwall tz300p firmware
- sonicwall tz300w firmware
- sonicwall tz350 firmware
- sonicwall tz350w firmware
- sonicwall tz370 firmware
- sonicwall tz370w firmware
- sonicwall tz400 firmware
- sonicwall tz400w firmware
- sonicwall tz470 firmware
- sonicwall tz470w firmware
- sonicwall tz500 firmware
- sonicwall tz500w firmware
- sonicwall tz570 firmware
- sonicwall tz570p firmware
- sonicwall tz570w firmware
- sonicwall tz600 firmware
- sonicwall tz600p firmware
- sonicwall tz670 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-22278 is a high vulnerability (CVSS 7.5) in Sonicwall Sonicos, published April 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. No source names a fixed version.