Researchers Uncover N-day Vulnerabilities in SonicWall SMA100 Series

Cybersecurity researchers at watchTowr Labs have uncovered three significant security vulnerabilities in SonicWall’s SMA100 series SSL-VPN appliances, raising concerns about pre-authentication attacks that could potentially compromise enterprise networks.

The vulnerabilities, disclosed on July 28, 2025, affect firmware version 10.2.1.15 and highlight persistent issues with HTTP header parsing in network security devices.

Critical Buffer Overflow Vulnerabilities Identified

The most severe of the discovered flaws are two buffer overflow vulnerabilities that can be triggered without authentication.

CVE-2025-40596 represents a stack-based buffer overflow that occurs when the device’s HTTP daemon processes specially crafted API requests.

According to watchTowr Labs researchers, the vulnerability stems from improper use of the sscanf function, which copies user-provided URI data into a fixed-size stack buffer without adequate bounds checking.

The second critical flaw, CVE-2025-40597, involves a heap-based buffer overflow in the mod_httprp.so module, which handles HTTP reverse proxy functionality.

Ironically, this vulnerability occurs despite developers attempting to use the “safer” __sprintf_chk function, but critically passing -1 as the size parameter, effectively disabling bounds checking entirely.

Both buffer overflow vulnerabilities can be triggered with minimal effort using simple HTTP requests, demonstrating the ease with which attackers could potentially exploit these flaws.

While stack protection mechanisms limit the immediate exploitability of the first vulnerability, the presence of pre-authentication buffer overflows in SSL-VPN devices represents a significant security concern.

Additional Cross-Site Scripting Vulnerability

The research team also identified CVE-2025-40598, a reflected cross-site scripting (XSS) vulnerability in the radiusChallengeLogin endpoint.

This flaw allows attackers to inject malicious scripts through the state parameter, which are then reflected directly in the server response without proper filtering.

Notably, the vulnerability persists despite the SMA100’s built-in web application firewall capabilities, which appear to be disabled on management interfaces.

Industry-Wide Security Concerns

The discoveries highlight broader systemic issues within the network appliance industry.

WatchTower Labs researchers expressed frustration with what they perceive as recurring patterns of preventable vulnerabilities, particularly noting that “pre-auth stack and heap overflows triggered by malformed HTTP headers aren’t supposed to happen anymore”.

The research organization emphasizes that its work represents just a fraction of the capabilities built into their commercial platform, which combines proactive threat intelligence with external attack surface management.

SonicWall has acknowledged the vulnerabilities and published an advisory addressing the issues.

These findings underscore the critical importance of thorough security testing and proper input validation in network security appliances, particularly those serving as gateway devices for enterprise networks.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates