SonicWall SMA100 Pre-Auth Vulnerability Exploitation Attempts CVE-2025-40596, CVE-2025-40597, CVE-2025-40598

Reyben Cortes@Reybendetecc

•updated Aug 5, 2025•1•2•31

This rule detects potential exploitation attempts against three pre-authentication vulnerabilities in SonicWall SMA100 series devices: CVE-2025-40596 (stack-based buffer overflow via long URI path), CVE-2025-40597 (heap-based buffer overflow via long Host header), and CVE-2025-40598 (reflected Cross-Site Scripting in /cgi-bin/radiusChallengeLogin).