Researchers Reveal Technical Details of SonicWall SMA100 Series N-Day Vulnerabilities

Security researchers have disclosed technical details of three previously patched vulnerabilities affecting SonicWall’s SMA100 series SSL-VPN appliances, highlighting concerning pre-authentication security flaws that could have enabled remote code execution and cross-site scripting attacks.

The vulnerabilities, all confirmed against firmware version 10.2.1.15, underscore persistent challenges in network appliance security despite decades of awareness around common programming pitfalls.

Critical Pre-Authentication Buffer Overflows Discovered

The research team from watchTowr Labs identified two distinct buffer overflow vulnerabilities that could be triggered without authentication, both stemming from inadequate input validation in HTTP request processing.

The first vulnerability, CVE-2025-40596, represents a stack-based buffer overflow in the httpd binary responsible for handling incoming HTTP requests to the SSL-VPN service.

This flaw occurs when the application processes URIs beginning with “/api/” through an unsafe sscanf function call that copies user-provided input into a fixed-size stack buffer without bounds checking.

Researchers demonstrated that the vulnerability could be triggered with a simple Python one-liner sending approximately 3,000 ‘A’ characters in the URI path.

While stack protection mechanisms limit immediate exploitation, the presence of such a fundamental programming error in a critical network security appliance raises significant concerns.

The second buffer overflow, CVE-2025-40597, affects heap memory allocation in the mod_httprp.so shared object library.

This vulnerability occurs during Host header parsing, where developers attempted to use the “safer” __sprintf_chk function but fatally undermined its protection by passing -1 as the size parameter, effectively disabling bounds checking entirely.

The flaw allows attackers to overflow a 128-byte heap-allocated buffer, potentially corrupting adjacent heap metadata and creating conditions for code execution.

The third vulnerability, CVE-2025-40598, represents a reflected cross-site scripting (XSS) flaw in the radiusChallengeLogin endpoint.

This vulnerability allows attackers to inject malicious JavaScript code via the state parameter, which is reflected directly into the response without filtering.

Notably, the SMA100’s built-in web application firewall appears inactive on management interfaces, allowing even basic XSS payloads to succeed.

The discovery of these vulnerabilities highlights ongoing challenges in secure coding practices within network appliance development.

The researchers noted particular concern that pre-authentication buffer overflows triggered by malformed HTTP headers continue to plague modern security devices, describing such issues as remnants of “a more naïve era of C programming.”

SonicWall has addressed these vulnerabilities through security updates, with details available in their official security advisory SNWLID-2025-0012.

 Organizations using SMA100 series appliances should prioritize applying available patches to mitigate potential exploitation risks.

The research underscores the continued importance of rigorous secure coding practices and comprehensive security testing in network infrastructure components, particularly those designed to protect organizational perimeters.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!