CVE-2025-40600

Published: Jul 29, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.

Affected (1)

Products: Sonicwall: Sonicos

Sonicwall

1 product

Sonicos

Configuration A

1 vulnerable · 22 platform

Vulnerable Software	Affected Versions
Sonicwall Sonicos	From 7.1.1-7040 to 7.3.0-7012

Running on/with	Platform Versions
Sonicwall Nsa 2700	All versions
Sonicwall Nsa 3700	All versions
Sonicwall Nsa 4700	All versions
Sonicwall Nsa 5700	All versions
Sonicwall Nsa 6700	All versions
Sonicwall Nssp 10700	All versions
Sonicwall Nssp 11700	All versions
Sonicwall Nssp 13700	All versions
Sonicwall Nssp 15700	All versions
Sonicwall Nsv270	All versions
Sonicwall Nsv470	All versions
Sonicwall Nsv870	All versions
Sonicwall Tz270	All versions
Sonicwall Tz270w	All versions
Sonicwall Tz370	All versions
Sonicwall Tz370w	All versions
Sonicwall Tz470	All versions
Sonicwall Tz470w	All versions
Sonicwall Tz570	All versions
Sonicwall Tz570p	All versions
Sonicwall Tz570w	All versions
Sonicwall Tz670	All versions

Related CWEs

CWE-134

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (1)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0013

Source: PSIRT@sonicwall.com

Vendor Advisory

Timeline

No history available yet.