SonicWall Warns of New SonicOS SSLVPN Pre-Auth Buffer Overflow Vulnerability (CVE-2025-40601)

SonicWall has issued a security advisory for a newly identified pre-authentication stack-based buffer overflow vulnerability in its SonicOS SSLVPN service. Tracked as CVE-2025-40601 and assigned a CVSS score of 7.5, the flaw could allow remote, unauthenticated attackers to crash affected firewalls, potentially disrupting business-critical network access.

According to the advisory, “A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.”

The company stresses that only devices with the SSLVPN interface or service enabled are exposed.

The vulnerability affects multiple generations of SonicWall hardware and virtual firewalls. SonicWall has released fixed versions for all affected platforms.

Until patches can be deployed, SonicWall provides a straightforward temporary mitigation: “Limit SonicOS SSLVPN access to trusted sources (and/or disable firewall SSLVPN service from untrusted internet sources) by modifying the existing SonicOS SSLVPN access rules.”

SonicWall includes referenced guides on how to restrict VPN access by user, service, destination, and WAN source IP addresses.

Related Posts:

• Akira Ransomware Exploits SonicWall SSLVPN Flaw (CVE-2024-40766)
• CVE-2023-0656: unauthenticated Denial of Service vulnerability in SONICOS
• Multi Vulnerabilities Found in SonicWall SMA 100 Series Prompt Urgent Security Update
• SonicWall Firewalls Under Attack: CVE-2024-53704 Exploited in the Wild, PoC Released
• High-Severity SonicWall SSLVPN Vulnerability Allows Firewall Crashing

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Do Son

Do Son (aka Ddos) is a seasoned news reporter, bringing over a decade of expertise to the forefront of cyber security and technology reporting. My work provides timely and insightful analysis of emerging trends and critical developments in these rapidly evolving sectors.