CVE-2025-40601: SonicOS SSLVPN Buffer Overflow Leads to Firewall Crash Risk, Patch Available

CVE-2025-40601 is a pre-authentication, stack-based buffer overflow in the SonicOS SSLVPN service that can let a remote unauthenticated attacker crash the firewall, causing a Denial-of-Service. The flaw affects Gen7 and Gen8 SonicWall firewalls, including Gen7 TZ270–TZ670, NSa 2700–6700, NSsp 10700–15700, Gen7 NSv270/470/870, and Gen8 TZ80–TZ680 and NSa 2800–5800, with Gen6, SMA 1000, and SMA 100 series not affected.

SonicWall reports a CVSS v3 score of 7.5 and notes that exploitation could impact availability but does not indicate RCE or data exposure. As of the advisory’s initial publication, SonicWall’s PSIRT says there was no known active exploitation in the wild.

Patches are available: Gen7 devices receive a fix in 7.3.1-7013 and later, Gen8 devices in 8.0.3-8011 and later, and administrators are urged to upgrade promptly; until patching, a workaround is to restrict SSLVPN access to trusted source IPs or disable SSLVPN from untrusted internet sources. According to the article, SOCRadar can help by monitoring for newly disclosed CVEs and mapping affected assets to prioritise patching. Nov 21, 2025