PT-2025-31264 · Sonicwall · Sonicos

Published 2025-07-29 · Updated 2025-08-14 · CVE-2025-40600

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SonicWall versions prior to 7.3.0-7012

Description A format string vulnerability exists in the SonicOS SSL VPN interface, allowing a remote, unauthenticated attacker to cause a denial-of-service (DoS) condition. The vulnerability is due to the improper handling of externally-controlled format strings.

Recommendations SonicWall versions prior to 7.3.0-7012 should be upgraded to version 7.3.0-7012 or later.

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2025-14516

CVE-2025-40600

Affected Products

Sonicos

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-40600 · Security Note
• https://bdu.fstec.ru/vul/2025-14516 · Security Note
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0013 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-40600 · Vendor Advisory
• https://twitter.com/CCBalert/status/1950564817799889201 · Twitter Post
• https://twitter.com/Netlas_io/status/1950469024418054525 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1950348003954331837 · Twitter Post
• https://twitter.com/autumn_good_35/status/1950371072614027405 · Twitter Post
• https://twitter.com/dailytechonx/status/1950651362737336397 · Twitter Post
• https://t.me/cveNotify/130190 · Telegram Post
• https://twitter.com/CVEnew/status/1950311127101165792 · Twitter Post
• https://twitter.com/rewterz/status/1950813750195286433 · Twitter Post
• https://twitter.com/DC3DCISE/status/1955989535868821569 · Twitter Post
• https://t.me/netlas/452 · Telegram Post
• https://t.me/cveNotify/130274 · Telegram Post