CVE-2025-40604 - CVE House
Back to Database
Status published Unknown CVE-2025-40604

Download of Code Without Integrity Check Vulnerability in the SonicWall...

Vulnerability Description

Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-40604

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Brian Mariani of DigitalCanion SA - www.digitalcanion.com

References

More from SonicWall

View All →
CVE-2025-40605
A Path Traversal vulnerability has been identified in the Email...
Unknown 0
CVE-2025-40603
A potential exposure of sensitive information in log files in...
Unknown 0
CVE-2025-40602
A local privilege escalation vulnerability due to insufficient authorization in...
Unknown 0
CVE-2025-40601
A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service...
Unknown 0
CVE-2025-40600
Use of Externally-Controlled Format String vulnerability in the SonicOS SSL...
Unknown 0

Affected Vendor

Affected Software

Email Security
Vulnerable Versions:
10.0.33.8195 and earlier versions

Timeline

Official Publish: November 20th, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-494

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.