Vulnerability in Sonicwall Email Security
CVE-2025-40604
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain pe…
EPSS: 0.002 (8.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sonicwall Email Security — versions 10.0.33.8195 and earlier versions
- Sonicwall Email_security_appliance_5000
- Sonicwall Email_security_appliance_5000_firmware
- Sonicwall Email_security_appliance_5050
- Sonicwall Email_security_appliance_5050_firmware
- Sonicwall Email_security_appliance_7000
- Sonicwall Email_security_appliance_7000_firmware
- Sonicwall Email_security_appliance_7050
- Sonicwall Email_security_appliance_7050_firmware
- Sonicwall Email_security_appliance_9000
Weakness classification (CWE)
References
- PSIRT@sonicwall.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-40604?
- CVE-2025-40604 is a critical-severity vulnerability in Sonicwall Email Security, classified under Download of Code Without Integrity Check. CVSS score: 9.8/10. Published 2025-11-20.
- How severe is CVE-2025-40604?
- Critical severity. CVSS v3 base score is 9.8 out of 10.