CVE-2025-40596

published 2025-07-23

CVE-2025-40596: A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or…

Priority P2 65 high 7.3 CVSS 3.1

AV N AC L PR N UI N S U C L I L A L

A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
sonicwall	sma_100_series	—	—
sonicwall	sma_210_firmware	< 10.2.2.1-90sv	10.2.2.1-90sv
sonicwall	sma_410_firmware	< 10.2.2.1-90sv	10.2.2.1-90sv
sonicwall	sma_500v_firmware	< 10.2.2.1-90sv	10.2.2.1-90sv

Detection & IOCs extracted from sources · hover to see the quote

path /__api__/

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS SonicWall Pre-Auth Stack-Based Buffer Overflow (CVE-2025-40596)"; flow:established,to_server; http.uri; bsize:>2059; content:"/__api__/"; startswith; reference:url,labs.watchtowr.com/stack-overflows-heap-overflows-and-existential-dread-sonicwall-sma100-cve-2025-40596-cve-2025-40597-and-cve-2025-40598/; reference:cve,2025-40596; classtype:web-application-attack; sid:2063847; rev:1; metadata:affected_product SonicWall, attack_target Server, tls_state TLSDecrypt, created_at 2025_07_31, cve CVE_2025_40596, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_31, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → CVE-2025-40596 exploits a stack-based buffer overflow triggered via unauthenticated HTTP POST requests to the /__api__/ CGI endpoint on SonicWall SMA100 series devices. Detection rule (ET sid:2063847) keys on HTTP URI starting with /__api__/ AND URI byte-size greater than 2059. ↗
• → Snort/Suricata rule sid:2063847 (ET) detects CVE-2025-40596 exploitation attempts: match on HTTP URI starting with /__api__/ with a URI byte-size exceeding 2059 bytes, inbound to the protected network.
• → TLS decryption is required for effective detection; the ET rule metadata specifies tls_state TLSDecrypt, meaning traffic to SMA100 devices must be decrypted before inspection.
• → Check Point IPS provides protection under the signature name 'SonicWall SMA100 Stack Overflow' for CVE-2025-40596. ↗
• → Successful exploitation of CVE-2025-40596 may result in remote code execution with root privileges on the SMA100 device. ↗

• · The ET Snort rule (sid:2063847) for CVE-2025-40596 requires TLS decryption (tls_state TLSDecrypt) to be effective, as SMA100 web traffic is typically HTTPS. Without inline TLS inspection, the rule will not fire.
• · The vulnerability is exploitable by remote, unauthenticated attackers, meaning no credentials or session tokens are required — perimeter-only controls (e.g., VPN authentication gates) do not mitigate the risk. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121