CVE-2025-40604

The SonicWall Email Security device loads root filesystem images during updates or startup without verifying their integrity or signature authenticity. An attacker with access to a VMDK file or datastore of the virtualized environment can substitute or modify these images. Once the manipulated image is loaded, malicious code is executed with system privileges, providing the attacker with persistent and arbitrary code execution on the device.

An attacker can obtain persistent, full control over the device through arbitrary code execution at the operating system level, which means complete violation of confidentiality, integrity, and availability of processed email and infrastructure.

Apply patches available from the vendor according to the references (https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018). Additionally, restrict access to VMDK files and datastores of the virtualized environment exclusively to trusted, authorized administrators and systems.

SonicWall Email Security Appliance 5000, SonicWall Email Security Appliance 5000 Firmware, SonicWall Email Security Appliance 5050 Firmware, SonicWall Email Security Appliance 7000, SonicWall Email Security Appliance 9000 — exact firmware versions indicated in vendor references.