> CVE-2025-40604

« BACK_TO_HOME
PUBLISHED
2025-11-20 15:17
MODIFIED
2025-11-20 15:17
EPSS (Prob. Exploit)
0.21%
Top 89.3%
DATA SOURCES:
NVD 🔗 2025-11-20 CVE PROJECT 🔗 2026-01-19 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08

> DESCRIPTION

Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-494

> CWE DETAILED DESCRIPTIONS

CWE-494: Download of Code Without Integrity Check - The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

> HISTORIQUE DES MODIFICATIONS

Première apparition
20/11/2025 15:17
Source: NVD
📊 ENRICHISSEMENT 19/01/2026 17:37
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 01/12/2025 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-494: Download of Code Without Integrity Check - The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integr...
Total des modifications: 2 Dernière mise à jour: 9 months ago

> REFERENCES

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018
« BACK_TO_HOME