SonicWall flags SSLVPN flaw allowing firewall crashes

SonicWall has flagged a high-severity vulnerability in its SonicOS SSLVPN service, tracked as CVE-2025-40601, which carries a CVSS score of 7.5 and can cause denial of service by crashing Gen7 and Gen8 firewalls. The issue stems from a stack-based buffer overflow in the SSLVPN interface or service when enabled on the firewall.

Affected devices include Gen7 hardware firewalls and Gen8 firewalls, with specific versions cited as 7.3.0-7012 and older (noting that 7.0.1 branch is not affected) and 8.0.2-8011 and older, with patches urged to be applied urgently. Admins unable to patch are advised to disable SonicOS SSLVPN or restrict firewall access to trusted sources to reduce exposure. According to SonicWall PSIRT, the firm is not aware of active exploitation in the wild and no PoC has been made public.