CVE-2025-40598

EPSS 54.86%
Veröffentlicht 23.07.2025 14:49:48
Zuletzt bearbeitet 07.08.2025 14:36:07
Erkennungen
Login

A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 5

NVD 3 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Sonicwall ≫ Sma 500v Firmware Version < 10.2.2.1-90sv

Sonicwall ≫ Sma 500v Version -

Sonicwall ≫ Sma 210 Firmware Version < 10.2.2.1-90sv

Sonicwall ≫ Sma 210 Version -

Sonicwall ≫ Sma 410 Firmware Version < 10.2.2.1-90sv

Sonicwall ≫ Sma 410 Version -

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	54.86%	0.989

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
CISA-ADP	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0012

Vendor Advisory

https://labs.watchtowr.com/stack-overflows-heap-overflows-and-existential-dread-sonicwall-sma100-cve-2025-40596-cve-2025-40597-and-cve-2025-40598/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-40598

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-40598

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-40598

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2025-40598