CVE-2025-40597

published 2025-07-23

CVE-2025-40597: A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or…

Priority P2 61 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
sonicwall	sma_100_series	—	—
sonicwall	sma_210_firmware	< 10.2.2.1-90sv	10.2.2.1-90sv
sonicwall	sma_410_firmware	< 10.2.2.1-90sv	10.2.2.1-90sv
sonicwall	sma_500v_firmware	< 10.2.2.1-90sv	10.2.2.1-90sv

Detection & IOCs extracted from sources · hover to see the quote

path /__api__/

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS SonicWall Pre-Auth Heap-Based Buffer Overflow (CVE-2025-40597)"; flow:established,to_server; http.uri; content:"/__api__/"; fast_pattern; http.host; bsize:>128; reference:url,labs.watchtowr.com/stack-overflows-heap-overflows-and-existential-dread-sonicwall-sma100-cve-2025-40596-cve-2025-40597-and-cve-2025-40598/; reference:cve,2025-40597; classtype:web-application-attack; sid:2063848; rev:1; metadata:affected_product SonicWall, attack_target Server, tls_state TLSDecrypt, created_at 2025_07_31, cve CVE_2025_40597, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_31, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → CVE-2025-40597 exploit traffic targets the /__api__/ URI path via HTTP POST with an anomalously large Host header (bsize > 128 bytes), indicating a heap-based buffer overflow attempt against SonicWall SMA100 web interface.
• → All three SMA100 CVEs (CVE-2025-40596, CVE-2025-40597, CVE-2025-40598) are triggerable via unauthenticated HTTP POST requests to a CGI endpoint, enabling pre-auth exploitation. ↗
• → Successful exploitation of CVE-2025-40597 may lead to remote code execution with root privileges on SonicWall SMA100 series devices. ↗
• → Snort/Suricata SID 2063848 (ET, rev:1, created 2025-07-31) detects CVE-2025-40597 heap overflow exploitation attempts; requires TLS decryption (tls_state TLSDecrypt) for full coverage.
• → Check Point IPS provides protection under the signature name 'SonicWall SMA100 Stack Overflow' covering CVE-2025-40596, CVE-2025-40597, and CVE-2025-40598. ↗

• · The Snort/Suricata rule for CVE-2025-40597 (SID 2063848) requires TLS decryption to be effective, as the metadata specifies tls_state TLSDecrypt. Without TLS inspection enabled on the sensor, the rule will not fire on encrypted traffic.
• · The rule is designed for both Perimeter and Internal deployment contexts, meaning it should be deployed on sensors monitoring both north-south and east-west traffic to SonicWall SMA100 devices.

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-122