Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint.
CVE-2025-40602 is a high-severity vulnerability affecting SonicWall SMA 100 series appliances, which are critical for secure remote access and network security. The vulnerability has been actively exploited in the wild, allowing attackers to potentially gain unauthorized access or disrupt services without requiring user interaction. European organizations relying on these appliances, especially in sectors dependent on VPN and remote access, face significant risk. Immediate patching, enhanced monitoring, and network segmentation are essential mitigation steps. Germany, France, and the UK are the most likely affected countries due to high SonicWall market penetration and critical infrastructure reliance. The threat impacts confidentiality and availability, with ease of exploitation and broad scope, warranting a high severity rating. Defenders should prioritize applying patches, reviewing access logs, and reinforcing perimeter defenses to mitigate this threat effectively.
A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.
A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../) and may access files and directories outside the intended restricted path.
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain conditions to view partial users credential data.
Salt Typhoon, a China-linked cyber espionage group, exploited a zero-day vulnerability (CVE-2024-40766) in Citrix NetScaler Gateway appliances to target a European telecommunications organization. The attackers used DLL sideloading to deploy the SNAPPYBEE backdoor and leveraged LightNode VPS endpoints for command and control. The intrusion involved lateral movement from the compromised gateway to Citrix VDA hosts with the intent of data exfiltration. Darktrace detected the attack early through anomaly-based detection, enabling containment before significant damage occurred. No known exploits are currently in the wild. The threat demonstrates sophisticated stealth techniques by state-sponsored actors targeting critical infrastructure. Organizations using Citrix infrastructure, especially in telecommunications, should monitor proactively and apply patches when available. The suggested severity is medium due to the targeted nature and exploitation complexity.
Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.
A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.
A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.
A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.
An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.
A vulnerability in the Gen7 SonicOS Cloud platform NSv, allows a remote authenticated local low-privileged attacker to elevate privileges to `root` and potentially lead to code execution.
CVE-2019-7483 is a high-severity unauthenticated directory traversal vulnerability in SonicWall SMA100 devices. It exists in the handleWAFRedirect CGI, allowing attackers to test for the presence of files on the server. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
CVE-2021-20028 is a high-severity SQL injection vulnerability in SonicWall Secure Remote Access (SRA) products. It arises from improper neutralization of SQL commands, allowing attackers to inject malicious SQL code. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.
