Loading story…
SonicWall has disclosed a critical buffer overflow vulnerability, tracked as CVE-2025-40601, in the SSLVPN service of its SonicOS operating system. This flaw allows remote, unauthenticated attackers to trigger a firewall crash, resulting in a Denial-of-Service (DoS) condition. The vulnerability affects both hardware and virtual firewalls in the Gen7 and Gen8 product lines, including models such as TZ270–TZ670, NSa 2700–6700, NSsp 10700–15700, and their virtual equivalents on platforms like ESX, KVM, Hyper-V, AWS, and Azure. The issue is present in software versions Gen7 7.3.0-7012 and older, and Gen8 8.0.2-8011 and older, but does not impact Gen6 or SMA series devices.
SonicWall has released patches to address the vulnerability and recommends immediate updates for affected systems. There is currently no evidence of active exploitation or remote code execution capabilities associated with this flaw; the primary risk is service disruption due to firewall crashes. Administrators are urged to verify whether the SSLVPN interface is enabled and to apply the necessary security updates to mitigate potential DoS attacks targeting this vulnerability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
At disclosure, reports indicated that a vendor fix was available for affected SonicWall firewall products. The update was presented as the recommended mitigation for the SSLVPN buffer overflow issue.
SonicWall warned of a new pre-authentication buffer overflow vulnerability, CVE-2025-40601, affecting SonicOS SSLVPN. The flaw could allow a remote attacker to trigger firewall crashes, causing denial-of-service conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethecyberthrone.in
Open sourcesecurityonline.info
Open sourcesocradar.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SonicWall has released security advisories addressing multiple vulnerabilities affecting its Email Security appliances and Gen7/Gen8 hardware and virtual firewalls. The most critical issue is a stack-based buffer overflow vulnerability in the SonicOS SSLVPN service, tracked as CVE-2025-40601, which allows remote unauthenticated attackers to cause a denial-of-service condition and crash impacted firewalls. SonicWall has stated that there is no evidence of active exploitation or public proof-of-concept code for this vulnerability, but urges immediate patching. The affected products include various models of Gen7 and Gen8 firewalls, with fixed versions now available. Gen6 firewalls and SMA SSL VPN products are not affected. In addition to the firewall vulnerability, SonicWall also patched two vulnerabilities in its Email Security appliances, which could enable remote attackers to compromise these systems. Administrators unable to immediately apply the updates are advised to disable the SSLVPN service or restrict access to trusted sources as a temporary mitigation. The Canadian Centre for Cyber Security and SonicWall both recommend that users and administrators review the advisories and apply the necessary updates to protect their environments from potential exploitation.
Jun 29, 2026
SonicWall issued fixes for multiple high-severity SonicOS vulnerabilities affecting Gen6, Gen7, NSv, and TZ80 firewalls, led by **`CVE-2024-53704`**, a critical SSL VPN authentication bypass that lets a remote, unauthenticated attacker hijack an active VPN session with a crafted session cookie. Successful exploitation can give an attacker the victim’s internal network access, expose Virtual Office bookmarks, allow retrieval of a NetExtender client profile, and enable establishment of a VPN tunnel; the attacker can also terminate the legitimate user’s session. Additional patched flaws include privilege escalation, token prediction that can lead to unauthorized access, and SSRF through the SSH management interface. Bishop Fox later published technical analysis and a working exploit for `CVE-2024-53704`, reporting that exploitation becomes trivial once the flaw is understood and relies on crafted Base64-encoded session cookies containing null bytes. The researchers said roughly 4,500 internet-facing SonicWall SSL VPN servers remained unpatched in early February 2025, increasing exposure, while CSIRT.SK warned that public exploit details raise the likelihood of targeted attacks. SonicWall and downstream defenders urged immediate firmware upgrades and tighter restriction of firewall management interfaces, noting that detection is difficult but that SSL VPN logs showing the same session used from multiple source IP addresses may indicate hijacking.
Jul 24, 2026
SonicWall disclosed multiple vulnerabilities in **SonicOS** affecting Generation 6, 7, and 8 hardware and virtual firewall products, including flaws that could let attackers bypass access controls, reach restricted services, or trigger denial of service by crashing firewalls. The issues, identified by CrowdStrike’s Advanced Research Team and tracked as `CVE-2026-0204`, `CVE-2026-0205`, and `CVE-2026-0206`, carry CVSS scores of **8.0**, **6.8**, and **4.9** respectively, and were also reflected in advisory **dCERT 2026-1294**. SonicWall released fixed firmware versions and urged administrators to apply updates immediately. Where patching cannot be completed at once, the company advised disabling **HTTP/HTTPS management** and **SSLVPN** on all interfaces and restricting management access to **SSH**. SonicWall also warned Generation 6 customers not to downgrade from patched firmware, saying a rollback will delete LDAP users and reset MFA configurations.
Jun 29, 2026