{"id":"CVE-2025-40604","aliases":["EUVD-2025-198274","GHSA-pcxg-qcmm-jh7x"],"status":"published","title":"Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance...","description":"Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00206,"percentile":0.10738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-494"],"published":"2025-11-20T12:17:14Z","modified":"2026-10-18T20:10:00Z","products":[{"vendor":"sonicwall","product":"email security"},{"vendor":"sonicwall","product":"email_security_appliance_5000_firmware"},{"vendor":"sonicwall","product":"email_security_appliance_5050_firmware"},{"vendor":"sonicwall","product":"email_security_appliance_7000_firmware"},{"vendor":"sonicwall","product":"email_security_appliance_7050_firmware"},{"vendor":"sonicwall","product":"email_security_appliance_9000_firmware"}],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40604"},{"url":"https://github.com/advisories/GHSA-pcxg-qcmm-jh7x"}],"sources":{"cve":[{"id":"CVE-2025-40604","description":"Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.","status":"published","published":"2025-11-20T12:17:14.138Z","modified":"2026-02-26T16:07:45.738Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-198274","description":"Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.","status":"published","published":"2025-11-20T12:17:14Z","modified":"2026-02-26T16:07:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:25.997368Z"}],"ghsa":[{"id":"GHSA-pcxg-qcmm-jh7x","title":"Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance...","description":"Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.","status":"published","published":"2025-11-20T15:30:23Z","modified":"2025-11-20T21:31:39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T15:04:54.23412Z"}],"nvd":[{"id":"CVE-2025-40604","description":"Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.","status":"published","published":"2025-11-20T15:17:28.75Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:11:46.009629Z"}]}}