SonicWall tells customers to patch SonicOS flaw allowing hackers to crash firewalls

Image credit: Pixabay (Image credit: Pixabay)

SonicWall patches SSLVPN flaw CVE-2025-40601, enabling unauthenticated DoS attacks on Gen7/Gen8 firewalls
No exploitation seen yet; users urged to disable SSLVPN or restrict access if updates delayed
Two Email Security appliance flaws (CVE-2025-40604/40605) also fixed, preventing code execution and data access

SonicWall has released a patch for a high-severity vulnerability in its SonicOS SSLVPN service, and urged all users to update their firewalls immediately.

In a security advisory, the company said it discovered a stack-based buffer overflow vulnerability in the SonicOS SSLVPN service, which allows a remote, unauthenticated attacker to cause Denial of Service (DoS) and essentially crash the firewall.

The vulnerability is now tracked as CVE-2025-40601 and was given a severity score of 7.5/10 (high). It impacts Gen8 and Gen7 firewalls, both hardware and virtual ones. Earlier models, such as Gen6 firewalls, or the SMA 1000 and SMA 100 series SSL VPN products, were said to be safe against this bug.

SonicWall also noted the bug only impacts the SSLVPN interface or service, if it’s enabled on the firewall.

No evidence or PoC

There is no evidence that this vulnerability is being exploited in the wild, but cybercriminals often wait for a bug to be publicized first, before striking.

Hunting for zero-day flaws is hard, and many companies do not patch their technologies on time, leaving the front doors wide open for attackers. So far, there has been no Proof-of-Concept (PoC) on the internet.

If you are unable to update your firewall at this moment, you should disable the SonicOS SSLVPN service or update the rules to limit access to the SonicWall firewall applications to trusted sources only, since firewalls are one of the most popular targets among cybercriminals.

At the same time, SonicWall also fixed two vulnerabilities in its Email Security appliances (ES Appliance 5000, 5050, 7000, 7050, 9000, VMWare, and Hyper-V), tracked as CVE-2025-40604, and CVE-2025-40605. These allow threat actors to gain persistent arbitrary code execution capabilities, as well as access to restricted information.

For this patch, SonicWall also “strongly advised” users to install the patch without hesitation.

Via BleepingComputer

The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.