Quick Summary
SonicWall has issued a warning about a medium-severity local privilege escalation vulnerability (CVE-2025-40602) in the SMA1000 Appliance Management Console. This flaw, reported by Google Threat Intelligence, can be exploited in zero-day attacks when combined with a critical-severity pre-authentication deserialization flaw (CVE-2025-23006). Over 950 SMA1000 appliances are currently exposed online, posing a significant risk to organizations that rely on these devices for secure remote access.
The Securityish Brief
SonicWall has alerted users to a vulnerability in the SMA1000 Appliance Management Console, identified as CVE-2025-40602, which allows local privilege escalation. This flaw was reported by Clément Lecigne and Zander Work from the Google Threat Intelligence Group. The vulnerability does not impact SSL-VPN services running on SonicWall firewalls.
The vulnerability has been exploited in zero-day attacks when combined with CVE-2025-23006, a critical-severity pre-authentication deserialization flaw with a CVSS score of 9.8. This combination enables unauthenticated remote code execution with root privileges. SonicWall has advised users to upgrade to the latest hotfix release version to mitigate this risk.
Currently, over 950 SMA1000 appliances are tracked as exposed online, according to internet watchdog Shadowserver. Given the critical role of these appliances in providing VPN access to corporate networks, unpatched vulnerabilities can lead to severe security breaches.
In the past, SonicWall has faced scrutiny over security incidents, including a September breach linked to state-sponsored hackers that exposed customer firewall configuration files. This history emphasizes the importance of timely updates and vigilance in monitoring device security.
Organizations using SMA1000 appliances should prioritize applying the latest patches and remain aware of potential threats. Regularly reviewing security configurations and monitoring for unusual activity can help mitigate risks associated with these vulnerabilities.
Key Takeaways
- Upgrade your SonicWall SMA1000 appliances to the latest hotfix release version to address the CVE-2025-40602 vulnerability.
- Check if your organization’s SMA1000 appliances are among the 950 currently exposed online and take necessary actions to secure them.
- Monitor for any unusual activity or unauthorized access attempts on your network to catch potential exploitation early.
- Review and update your security configurations regularly to ensure they align with best practices.
- Stay informed about security advisories from SonicWall and other cybersecurity sources to protect against emerging threats.
Key Terms & Concepts
- CVE-2025-40602: In this article, CVE-2025-40602 refers to a medium-severity local privilege escalation vulnerability in SonicWall’s SMA1000 Appliance Management Console.
- CVE-2025-23006: CVE-2025-23006 is a critical-severity pre-authentication deserialization flaw that allows unauthenticated remote code execution when exploited.
- SMA1000: The SMA1000 is a secure remote access appliance used by organizations to provide VPN access to corporate networks.
Read the original article here: https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-sma1000-zero-day-exploited-in-attacks/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
