SonicWall Email Security
En bref
- Source
- NVD
- EPSS
- EPSS 0.21 % · centile 11 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sonicwall
- Statut NVD
- Analyzed
Description
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
Faiblesses (CWE)
- CWE-494 — Téléchargement de code sans contrôle d'intégrité
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-198274
- GCVE · GCVE-0-2025-40604
Avis du CERT-FR
- CERTFR-2025-AVI-1027 — Multiples vulnérabilités dans les produits SonicWall · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:sonicwall:email_security_appliance_5000_firmware:*:*:*:*:*:*:*:*≤ 10.0.33.8195cpe:2.3:o:sonicwall:email_security_appliance_5050_firmware:*:*:*:*:*:*:*:*≤ 10.0.33.8195cpe:2.3:o:sonicwall:email_security_appliance_7000_firmware:*:*:*:*:*:*:*:*≤ 10.0.33.8195cpe:2.3:o:sonicwall:email_security_appliance_7050_firmware:*:*:*:*:*:*:*:*≤ 10.0.33.8195cpe:2.3:o:sonicwall:email_security_appliance_9000_firmware:*:*:*:*:*:*:*:*≤ 10.0.33.8195
Produits affectés
| Produit | Versions |
|---|---|
| SonicWall · Email Security | affected 10.0.33.8195 and earlier versions |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |