CVE-2025-40600
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
Use of an externally-controlled format string vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.
Risk Assessment
An attacker can make the SSL VPN service unavailable, disrupting remote access for employees.
Recommendation
Update SonicOS to a patched version and consider limiting SSL VPN interface exposure to necessary addresses.
Other vulnerabilities in SonicOS
See all- CVE-2026-19868HighActively exploited
An authentication enforcement vulnerability in the SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
- CVE-2024-22394Critical
An improper authentication vulnerability has been identified in the SonicWall SonicOS SSL-VPN feature, which under specific conditions could allow a remote attacker to bypass authentication. This issue affects only firmware version SonicOS 7.1.1-7040.
- CVE-2023-0656High
A stack-based buffer overflow vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.
- CVE-2022-22274Critical
A stack-based buffer overflow vulnerability in SonicOS triggered via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially result in code execution in the firewall.
- CVE-2021-20031Medium
A Host Header Redirection vulnerability exists in SonicOS. A remote attacker could potentially redirect firewall management users to arbitrary web domains.
- CVE-2020-5135CriticalActively exploited
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. It affects SonicOS Gen 6 versions 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
- CVE-2026-82308High
A pre-authentication heap-based buffer overflow vulnerability was identified in the SonicOS SSL-VPN service. It could allow a remote unauthenticated attacker to cause an application-level denial of service.
- CVE-2026-77709Medium
A pre-authentication heap-based buffer overflow vulnerability was identified in the SonicOS TACACS+ authentication client. Under specific conditions it could allow a remote unauthenticated attacker to cause an application-level denial of service.
- CVE-2026-77708Medium
A pre-authentication stack-based buffer overflow vulnerability was identified in the SonicOS TACACS+ authentication client. Under specific conditions it could allow a remote unauthenticated attacker to cause an application-level denial of service.
- CVE-2026-19703Medium
A weak password hashing vulnerability has been identified on SonicOS virtual appliances. Under specific conditions, an attacker with existing local access could disclose a platform credential that grants access to a limited subset of platform settings.
Original NVD description (English source)
Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS