Buffer Overflows & XSS in SonicWall SMA 100 Expose Devices to RCE – Patch Immediately!

SonicWall has released a security updates for its Secure Mobile Access (SMA) 100 series appliances, addressing three newly disclosed vulnerabilities that impact versions up to 10.2.1.15-81sv.

The advisory highlights the discovery of two buffer overflow vulnerabilities and one cross-site scripting (XSS) flaw, all exploitable by unauthenticated attackers through the SMA100 web interface:

• CVE-2025-40596 – Stack-Based Buffer Overflow (CVSS 7.3)

“A stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution,” the advisory explains.

This high-severity flaw allows attackers to crash the system or execute arbitrary code without prior authentication, posing a significant threat to network security.

• CVE-2025-40597 – Heap-Based Buffer Overflow (CVSS 7.3)

“A heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution,” the advisory states.

Similar to CVE-2025-40596, this vulnerability affects dynamic memory allocation and could lead to service disruption or arbitrary code execution under specific conditions.

• CVE-2025-40598 – Reflected Cross-Site Scripting (CVSS 6.3)

“A reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code,” the advisory writes.

While not as severe as the buffer overflow flaws, the XSS vulnerability could be used in phishing or social engineering attacks to hijack sessions or perform malicious actions within the context of the victim’s browser.

The vulnerabilities affect the following models and software versions:

Fixed Product(s)	Fixed Versions
SMA 100 Series (SMA 210, 410, 500v)	10.2.2.1-90sv and higher versions.

Although SonicWall confirmed there is “currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild,” security experts caution that pre-authentication vulnerabilities are prime targets for future exploitation, especially with the growing prevalence of remote work infrastructures.

Related Posts:

• Multiple Vulnerabilities in SonicWall SMA 100 Could Lead to Remote Code Execution
• Critical Vulnerabilities Patched in SonicWall SMA100, PoC Published
• SonicWall Confirms Active Exploitation of SMA 100 Vulnerabilities – Urges Immediate Patching
• CISA Alert: Actively Exploited SonicWall SMA100 Vulnerability
• Multi Vulnerabilities Found in SonicWall SMA 100 Series Prompt Urgent Security Update