CVE-2025-40600
CRITICALDescription
Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.
Is your site exposed to CVE-2025-40600?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| sonicwall | sonicos |
| sonicwall | nsa_2700 |
| sonicwall | nsa_3700 |
| sonicwall | nsa_4700 |
| sonicwall | nsa_5700 |
| sonicwall | nsa_6700 |
| sonicwall | nssp_10700 |
| sonicwall | nssp_11700 |
| sonicwall | nssp_13700 |
| sonicwall | nssp_15700 |
| sonicwall | nsv270 |
| sonicwall | nsv470 |
| sonicwall | nsv870 |
| sonicwall | tz270 |
| sonicwall | tz270w |
| sonicwall | tz370 |
| sonicwall | tz370w |
| sonicwall | tz470 |
| sonicwall | tz470w |
| sonicwall | tz570 |
| sonicwall | tz570p |
| sonicwall | tz570w |
| sonicwall | tz670 |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2025-40600? +
How severe is CVE-2025-40600? +
What products are affected by CVE-2025-40600? +
How do I check if I'm vulnerable to CVE-2025-40600? +
Related Vulnerabilities
Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing …
A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort …
An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of …
ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending …
An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly …
WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application …