CVSS 3.1
7.5 highCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-47522
High (7.5). EPSS 0.9% chance of exploitation in the next 30 days.
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
- CWE
- CWE-290
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ieee:ieee_802.11
- sonicwall:soho_250_firmware
- sonicwall:soho_250w_firmware
- sonicwall:sonicwave_224w_firmware
- sonicwall:sonicwave_231c_firmware
- sonicwall:sonicwave_432o_firmware
- sonicwall:sonicwave_621_firmware
- sonicwall:sonicwave_641_firmware
- sonicwall:sonicwave_681_firmware
- sonicwall:tz270_firmware
- sonicwall:tz270w_firmware
- sonicwall:tz300_firmware
- sonicwall:tz300p_firmware
- sonicwall:tz300w_firmware
- sonicwall:tz350_firmware
- sonicwall:tz350w_firmware
- sonicwall:tz370_firmware
- sonicwall:tz370w_firmware
- sonicwall:tz400_firmware
- sonicwall:tz400w_firmware
- sonicwall:tz470_firmware
- sonicwall:tz470w_firmware
- sonicwall:tz500_firmware
- sonicwall:tz500w_firmware
- sonicwall:tz570_firmware
- sonicwall:tz570p_firmware
- sonicwall:tz570w_firmware
- sonicwall:tz600_firmware
- sonicwall:tz600p_firmware
- sonicwall:tz670_firmware