Vulnerability Intelligence Report
CVE-2025-40604
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
No Active Exploit Signals
CVSS Base Score
6.5
MEDIUM
Exploitability:3.9
Impact Score:2.6
EPSS Probability:0.17%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-494 ↗CWE-494 Download of Code Without Integrity Check
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| SonicWall | Email Security | 10.0.33.8195 and earlier versions (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.168%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | SonicWall, Inc. · Vendor · USA |
| Reserved | 2025-04-16T08:34:51 |
| Published | 2025-11-20T12:17:14 |
| Patch Date | 2025-11-20 |
| Last Updated | 2026-02-26T16:07:45 |
Community Chatter & Buzz