SonicOS SSLVPN Vulnerability Allows Attackers To Crash the Firewall Remotely (CVE-2025-40601)

Du'aine Davis

For awareness

• On 21 November, SonicWall disclosed a critical vulnerability (CVE-2025-40601) in its SonicOS SSLVPN service on 21 November 2025. The flaw, a stack-based buffer overflow (CWE-121), allows remote unauthenticated attackers to crash affected firewalls via denial-of-service attacks. It impacts Gen7 and Gen8 SonicWall hardware and virtual firewalls running older firmware versions, but Gen6 and SMA SSL VPN products are unaffected.
• The vulnerability resides in the SSLVPN component of SonicOS. Exploitation requires sending specially crafted requests to the SSLVPN interface without authentication, triggering a buffer overflow and causing the firewall to crash. SonicWall reports no active exploitation or public proof-of-concept code at this time.
• Organisations should immediately update to patched firmware (Gen7: 7.3.1-7013+, Gen8: 8.0.3-8011+). Until updates are applied, restrict SSLVPN access to trusted source IPs only or disable SSLVPN from untrusted internet sources by modifying access rules. Monitoring for abnormal SSLVPN traffic and applying Microsoft Defender’s network protection policies can help detect suspicious behaviour. patterns.

NVD - CVE-2025-40601
SonicWall - Security Advisory