Critical severity9.8NVD Advisory· Published Nov 20, 2025· Updated Jun 17, 2026
CVE-2025-40604
CVE-2025-40604
Description
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
Affected products
7- cpe:2.3:o:sonicwall:email_security_appliance_5000_firmware:*:*:*:*:*:*:*:*Range: <=10.0.33.8195
- cpe:2.3:o:sonicwall:email_security_appliance_5050_firmware:*:*:*:*:*:*:*:*Range: <=10.0.33.8195
- cpe:2.3:o:sonicwall:email_security_appliance_7000_firmware:*:*:*:*:*:*:*:*Range: <=10.0.33.8195
- cpe:2.3:o:sonicwall:email_security_appliance_7050_firmware:*:*:*:*:*:*:*:*Range: <=10.0.33.8195
- cpe:2.3:o:sonicwall:email_security_appliance_9000_firmware:*:*:*:*:*:*:*:*Range: <=10.0.33.8195
- Range: 10.0.33.8195 and earlier versions
Patches
Vulnerability mechanics
References
1- psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018nvdVendor Advisory
News mentions
0No linked articles in our index yet.