Database/Firmware, BMC & network fabric
SonicWall SonicOS SSL VPN: format-string flaw lets unauthenticated attackers disrupt the service
Impact
An unauthenticated remote attacker can send input that is used as a format string in the SSL VPN interface and disrupt the service. The description only claims a denial of service, although NVD scores it 9.8. If the firewall carries remote or out-of-band access to the cluster, operators lose that path while the service is down. The record does not establish code execution.
Who can reach it
Remote and unauthenticated, from anyone who can reach the SSL VPN interface.
What to do
Apply the fixed SonicOS firmware listed in SNWLID-2025-0013. That is a firewall firmware upgrade and reboot, or a failover to an HA peer. Until then, limit SSL VPN exposure to trusted source addresses or disable it.
References
Related entries
- Ampere AmpereOne AC03 before 3.5.9.3, AC04 before 4.4.5.2, AmpereOne M before 5.4.5.1CVE-2025-62863 · Ampere AmpereOne AC03 before 3.5.9.3, AC04 before 4.4.5.2, AmpereOne M before 5.4.5.1 - UEFI Management Mode PCIe…Critical
- AmpereOne firmware: malformed SMC call to UEFI-MM MMCommunicate causes out-of-bounds write in the Secure PartitionCVE-2025-62864 · Ampere AmpereOne AC03/AC04/M firmware (UEFI-MM MMCommunicate SMC handler)Critical
- Linux NFS-over-RDMA server (svcrdma, svc_rdma_copy_inline_range): The inline copy path adds a page index where itCVE-2025-68811 · Linux NFS-over-RDMA server (svcrdma, svc_rdma_copy_inline_range)Critical
- Linux NFS-over-RDMA server (svcrdma, svc_rdma_copy_inline_range): svc_rdma_copy_inline_range indexes rq_pages with anCVE-2025-71068 · Linux NFS-over-RDMA server (svcrdma, svc_rdma_copy_inline_range)Critical
- Linux RDMA/srpt: failed multi-buffer descriptor setup leaves stale counters and a dangling rw_ctxs pointerCVE-2026-100075 · Linux kernel RDMA/srpt (SRP target, srpt_alloc_rw_ctxs unwind)Critical
- Supermicro BMC: IPMI fails to enforce session integrity, letting crafted packets run commandsCVE-2026-18450 · Supermicro BMC (IPMI session integrity and encryption enforcement)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.