CVE-2025-40600

The vulnerability stems from the use of a format string controlled by external input (Use of Externally-Controlled Format String, CWE-134). An attacker can send a specially crafted request to the SSL VPN interface without needing to have authentication. Improper processing of the format string by the vulnerable function can lead to service disruption.

An attacker can cause disruption or unavailability of the SSL VPN service on the device (denial of service attack). The CVSS vector also indicates potential impact on data confidentiality and integrity.

Patches available from the manufacturer should be applied according to the references (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0013). Until the fix is deployed, it is recommended to restrict access to the SSL VPN interface only to trusted IP addresses and monitor anomalies in traffic directed to this interface.

SonicWall NSSP 13700, SonicWall NSA 2700, SonicWall NSV 270, SonicWall NSV 870, SonicWall NSA 4700 with SonicOS software containing the vulnerable SSL VPN interface; specific versions indicated in the manufacturer's references.