Login Request a demo
Critical severity · published Nov 20, 2025
CVE-2025-40604
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with…
9.8
CVSS
0.2%
EPSS
No
On KEV
Description
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Email Security Appliance 5000 Firmware · Sonicwall
through 10.0.33.8195 · source: NVD
ES
Email Security Appliance 5050 Firmware · Sonicwall
through 10.0.33.8195 · source: NVD
ES
Email Security Appliance 7000 Firmware · Sonicwall
through 10.0.33.8195 · source: NVD
ES
Email Security Appliance 7050 Firmware · Sonicwall
through 10.0.33.8195 · source: NVD
ES
Email Security Appliance 9000 Firmware · Sonicwall
through 10.0.33.8195 · source: NVD
Affected product
ES
Email Security Appliance 5000 Firmware
Sonicwall
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40604
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40604
Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018
More from Email Security Appliance 5000 Firmware
9.8
CVE-2021-20021
SonicWall Email Security Improper Privilege Management Vulnerability
7.2
CVE-2021-20022
SonicWall Email Security Unrestricted Upload of File Vulnerability
4.9
CVE-2021-20023
SonicWall Email Security Path Traversal Vulnerability
5.3
CVE-2025-40605
A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal…