A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• sonicwall sonicosup to 6.0.5.3 inclusive
• sonicwall sonicos6.5.0.0 and later · up to 6.5.1.11 inclusive
• sonicwall sonicos6.5.4.0 and later · up to 6.5.4.7 inclusive
• sonicwall sonicos7.0.0.0
• sonicwall sonicosvup to 6.5.4.4 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (sonicwall). Independent of NVD's CPE analysis and usually ahead of it.

• SonicWall SonicOS

  • SonicOS 6.5.4.7-79n and earlier, SonicOS 6.5.1.11-4n and earlier, SonicOS 6.0.5.3-93o and earlier, SonicOSv 6.5.4.4-44v-21-794 and earlier, SonicOS 7.0.0.0-1affected

Other highest-scoring records for the same primary product.

• CVE-2024-53704An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.KEV
  98Now
• CVE-2024-40766An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorizedKEV
  75This week
• CVE-2022-22274A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Serv
  62This week
• CVE-2023-0656A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which
  42Plan
• CVE-2025-40600Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause
  39Monitor
• CVE-2024-40765An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of S
  39Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.