American cybersecurity firm SonicWall urged clients right now to patch a high-severity SonicOS SSLVPN security flaw that may enable attackers to crash weak firewalls.
Tracked as CVE-2025-40601, this denial-of-service vulnerability is attributable to a stack-based buffer overflow impacting Gen8 and Gen7 ({hardware} and digital) firewalls.
“A Stack-based buffer overflow vulnerability within the SonicOS SSLVPN service permits a distant unauthenticated attacker to trigger Denial of Service (DoS), which might trigger an impacted firewall to crash,” SonicWall mentioned.
“SonicWall PSIRT isn’t conscious of lively exploitation within the wild. No reviews of a PoC have been made public and malicious use of this vulnerability has not been reported to SonicWall.”
Nonetheless, the corporate added that its Gen6 firewalls, in addition to the SMA 1000 and SMA 100 collection SSL VPN merchandise, should not weak to assaults probably focusing on this vulnerability.
Whereas SonicWall has but to search out any proof that attackers are exploiting CVE-2025-40601 within the wild, the corporate “strongly” urged community defenders to use the steerage shared in right now’s security advisory.
| Affected Platforms | Fastened variations |
| Gen7 {hardware} Firewalls – TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700, NSsp 15700 Gen7 digital Firewalls (NSv) – NSV270, NSv470, NSv870 (ESX, KVM, HYPER-V, AWS, Azure) |
7.3.1-7013 and better variations |
| Gen8 Firewalls – TZ80, TZ280, TZ380, TZ480, TZ580, TZ680, NSa 2800, NSa 3800, NSa 4800, NSa 5800 | 8.0.3-8011 and better variations |
Admins who cannot instantly deploy right now’s security updates are suggested to disable the SonicOS SSLVPN service or to change guidelines to restrict entry to the SonicWall firewall equipment to trusted sources.
As we speak, the cybersecurity agency additionally patched two vulnerabilities impacting its E mail Safety home equipment (ES Equipment 5000, 5050, 7000, 7050, 9000, VMWare, and Hyper-V), enabling distant attackers to achieve persistent arbitrary code execution (CVE-2025-40604) and entry restricted info (CVE-2025-40605).
“SonicWall strongly advises customers of the E mail Safety merchandise (ES Equipment 5000, 5050, 7000, 7050, 9000, VMWare and Hyper-V) to improve,” it famous in a separate advisory.
Earlier this month, SonicWall confirmed {that a} state-sponsored hacking group was behind a September security breach that uncovered clients’ firewall configuration backup recordsdata, roughly one month after researchers warned that menace actors had compromised over 100 SonicWall SSLVPN accounts utilizing stolen credentials.
In September, it additionally launched a firmware replace to assist IT admins take away OVERSTEP rootkit malware deployed in assaults focusing on SMA 100 collection gadgets.
As MCP (Mannequin Context Protocol) turns into the usual for connecting LLMs to instruments and knowledge, security groups are shifting quick to maintain these new companies protected.
This free cheat sheet outlines 7 greatest practices you can begin utilizing right now.
