CVE-2025-40598: SonicWall SMA 100 Series · XSS or 'Cross-site Scripting'
Affects SonicWall SMA 100 SeriesSource CVE Database V5
Not known to be exploited · 46% EPSS · CVSS 6.1 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 46.1% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 23 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
European organizations should prioritize the following mitigation steps: 1) Immediately verify the SonicWall SMA 100 Series firmware version in use and plan for an upgrade to a patched version once available from SonicWall. 2) In the interim, restrict access to the SMA 100 Series web interface to trusted internal networks or VPNs, minimizing exposure to unauthenticated external attackers. 3) Implement strict web filtering and email security controls to reduce the risk of phishing attacks that could trigger user interaction with malicious payloads. 4) Employ Content Security Policy (CSP) headers and other browser-based protections to mitigate the impact of reflected XSS attacks. 5) Monitor logs for unusual access patterns or repeated attempts to exploit web interface parameters. 6) Educate users and administrators about the risks of clicking unsolicited links and the importance of verifying URLs before interaction. 7) Consider deploying Web Application Firewalls (WAFs) with custom rules to detect and block XSS attack vectors targeting the SMA interface. These measures, combined with timely patching, will reduce the attack surface and limit potential exploitation.
Description
A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.