Description
Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
CVSS Metrics
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- network
- Complexity
- low
- Privileges
- none
- User Action
- none
- Scope
- unchanged
- Confidentiality
- high
- Integrity
- high
- Availability
- high
- Weaknesses
- CWE-494
Metadata
- Primary Vendor
- SONICWALL
- Published
- 11/20/2025
- Last Modified
- 12/12/2025
- Source
- NIST NVD
- Note: Verify all details with official vendor sources before applying patches.
Affected Products
sonicwall : email_security_appliance_5000_firmwaresonicwall : email_security_appliance_5050_firmwaresonicwall : email_security_appliance_7000_firmwaresonicwall : email_security_appliance_7050_firmwaresonicwall : email_security_appliance_9000_firmware
AI-Powered Remediation
Generate remediation guidance or a C-suite brief for this vulnerability.