A newly disclosed vulnerability in SonicWall’s Connect Tunnel Windows Client could allow malicious actors to trigger denial-of-service (DoS) attacks or corrupt files, according to a recent security advisory (SNWLID-2025-0007) published by SonicWall on April 16, 2025.
The vulnerability, tracked as CVE-2025-32817 and rated with a CVSS v3 score of 6.1 (medium severity), stems from an improper link resolution issue (CWE-59) in the Connect Tunnel Windows Client, affecting both 32 and 64-bit versions prior to 12.4.3.298.
The flaw allows an attacker with local access to exploit the link resolution mechanism, potentially enabling the unauthorized overwriting of files.
This can lead to a denial of service (system or application crash) or file corruption, which may disrupt business operations.
The vulnerability was discovered and responsibly reported by CrisprXiang and Hao Huang with FDU, in collaboration with the Trend Micro Zero Day Initiative.
While the attacker must have local access to the affected system-limiting the risk compared to remote vulnerabilities ability to overwrite system files can be particularly damaging within organizational environments, potentially leading to downtime or the loss of critical data.
SonicWall urges all customers using the Connect Tunnel Windows Client to upgrade to version 12.4.3.298 or later immediately.
There are currently no alternative workarounds, so the software update is essential for protection.
| Element | Details |
| CVE | CVE-2025-32817 |
| Affected Versions | ≤ 12.4.3.283 (Windows 32/64-bit Client) |
| Remediation | Upgrade to 12.4.3.298 or later |
| Severity (CVSS v3) | 6.1 (Medium) |
| Research Credits | CrisprXiang, Hao Huang (FDU/Trend Micro) |
This vulnerability highlights the importance of keeping business-critical security software up to date.
Organizations leveraging SonicWall’s Connect Tunnel Windows Client should prioritize applying the latest security update to mitigate exploitation risks and maintain operational resilience.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…