SonicWall SonicOS SSLVPN: unauthenticated stack overflow crashes the firewall

Impact

A remote, unauthenticated attacker triggers a stack-based buffer overflow in the SSLVPN service and crashes the firewall. Remote access into the datacenter and all traffic through the appliance stop. The record describes denial of service only.

Who can reach it

Unauthenticated remote attacker who can reach the SSLVPN service.

What to do

Flash the fixed SonicOS firmware listed in SonicWall advisory SNWLID-2025-0016. The appliance reboots during the upgrade. Limiting SSLVPN exposure to trusted sources reduces the risk until then.

References

Related entries

• Arista DANZ Monitoring Fabric: restricted users can SSH-port-forward into host-internal servicesCVE-2025-54546 · Arista DANZ Monitoring Fabric (SSH port forwarding for restricted users)High
• Fujitsu / Fsas Technologies iRMC S6 BMC (M5-generation servers): A length-boundary bug in BMC authenticationCVE-2025-65002 · Fujitsu / Fsas Technologies iRMC S6 BMC (M5-generation servers)High
• Supermicro BMC: IPMI session integrity and encryption are not enforced, allowing command injection into a live sessionCVE-2026-18449 · Supermicro BMC (IPMI/RMCP+ session integrity and encryption enforcement)High
• IBM PowerVM partition firmware: malformed network-boot packet yields code execution inside the booting partitionCVE-2026-18821 · IBM PowerVM partition firmware (network boot packet handling)High
• SonicWall SonicOS: SSLVPN accepts an alternate auth method to bypass SAML and its enforced MFACVE-2026-19868 · SonicWall SonicOS SSLVPN (SAML authentication enforcement)High
• Linux kernel NVMe-oF TCP target (nvmet-tcp, H2C_DATA PDU before CONNECT): Nvmet_tcp_build_pdu_iovec() dereferences cmdCVE-2026-22998 · Linux kernel NVMe-oF TCP target (nvmet-tcp, H2C_DATA PDU before CONNECT)High