by Kastro
Paper/Archive/CVE-2025-40604

CVE-2025-40604

SonicWall Email Security — Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without ver…

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
32
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 10.7.107 × 202.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.

Affected

ProductAffectedFixed inSource
Email Security10.0.33.8195 and earlier versions–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorypsirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018