CVE-2025-40602: SonicWall Secure Mobile Access (SMA) 1000 Zero-Day Exploited
A zero-day vulnerability in SonicWall’s Secure Mobile Access (SMA) 1000 was reportedly exploited in the wild in a chained attack with CVE-2025-23006.
Key takeaways:
- CVE-2025-40602 is a local privilege escalation vulnerability in the appliance management console (AMC) of the SonicWall SMA 1000 appliance.
- CVE-2025-40602 has been exploited in a chained attack with CVE-2025-23006, a deserialization of untrusted data vulnerability patched in January.
- A list of Tenable plugins for this vulnerability can be found on the individual CVE pages for CVE-2025-40602 and CVE-2025-23006.
Background
On December 17, SonicWall published a security advisory (SNWLID-2025-0019) for a newly disclosed vulnerability in its Secure Mobile Access (SMA) 1000 product, a remote access solution.
| CVE | Description | CVSSv3 |
|---|---|---|
| CVE-2025-40602 | SonicWall SMA 1000 Privilege Escalation Vulnerability | 6.6 |
Analysis
CVE-2025-40602 is a local privilege escalation vulnerability in the appliance management console (AMC) of the SonicWall SMA 1000 appliance. An authenticated, remote attacker could exploit this vulnerability to escalate privileges on an affected device. While on its own, this flaw would require authentication in order to exploit, the advisory from SonicWall states that CVE-2025-40602 has been exploited in a chained attack with CVE-2025-23006, a deserialization of untrusted data vulnerability patched in January. The combination of these two vulnerabilities would allow an unauthenticated attacker to execute arbitrary code with root privileges.
According to SonicWall, “SonicWall Firewall products are not affected by this vulnerability.”
Historical exploitation of SonicWall vulnerabilities
SonicWall products have been a frequent target for attackers over the years. Specifically, the SMA product line has been targeted in the past by ransomware groups, as well as being featured in the Top Routinely Exploited Vulnerabilities list co-authored by multiple United States and International Agencies.
Earlier this year, an increase in ransomware activity tied to SonicWall Gen 7 Firewalls was observed. While initially it was believed that a new zero-day may have been the root cause, SonicWall later provided a statement noting that exploitation activity was in relation to CVE-2024-40766, an improper access control vulnerability which had been observed to have been exploited in the wild. More information on this can be found on our blog.
Given the past exploitation of SonicWall devices, we put together the following list of known SMA vulnerabilities that have been exploited in the wild:
| CVE | Description | Tenable Blog Links | Year |
|---|---|---|---|
| CVE-2019-7481 | SonicWall SMA100 SQL Injection Vulnerability | 1 | 2019 |
| CVE-2019-7483 | SonicWall SMA100 Directory Traversal Vulnerability | - | 2019 |
| CVE-2021-20016 | SonicWall SSLVPN SMA100 SQL Injection Vulnerability | 1, 2, 3, 4, 5 | 2021 |
| CVE-2021-20038 | SonicWall SMA100 Stack-based Buffer Overflow Vulnerability | 1, 2, 3 | 2021 |
| CVE-2025-23006 | SonicWall SMA 1000 Deserialization of Untrusted Data Vulnerability | 1 | 2025 |
| CVE-2024-40766 | SonicWall SonicOS Improper Access Control Vulnerability | 1 | 2025 |
Proof of concept
At the time this blog was published, no proof-of-concept (PoC) code had been published for CVE-2025-40602. If and when a public PoC exploit becomes available for CVE-2025-40602, we anticipate a variety of attackers will attempt to leverage this flaw as part of their attacks.
Solution
SonicWall has released patches to address this vulnerability as outlined in the table below:
| Affected Version | Fixed Version |
|---|---|
| 12.4.3-03093 and earlier | 12.4.3-03245 |
| 12.5.0-02002 and earlier | 12.5.0-02283 |
The advisory also provides a workaround to reduce potential impact. This involves restricting access to the AMC to trusted sources. We recommend reviewing the advisory for the most up to date information on patches and workaround steps.
Identifying affected systems
A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2025-40602 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline. In addition, product coverage for CVE-2025-23006 can be found here.
Tenable Attack Surface Management customers are able to identify these assets using a filtered search for SonicWall devices:
Get more information
- SonicWall SNWLID-2025-0019 Security Advisory
- Tenable Blog: CVE-2025-23006: SonicWall Secure Mobile Access (SMA) 1000 Zero-Day Reportedly Exploited
Join Tenable's Research Special Operations (RSO) Team on Tenable Connect and engage with us in the Threat Roundtable group for further discussions on the latest cyber threats.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Scott Caveza
Senior Staff Research Engineer, Research Special Operations
Scott joined Tenable in 2012 as a Research Engineer on the Nessus Plugins team. Over the years, he has written hundreds of plugins for Nessus, and reviewed code for even more from his time being a team lead and manager of the Plugins team. Previously leading the Security Response team and the Zero Day Research team, Scott is currently a member of the Research Special Operations team, helping the research organization respond to the latest threats. He has over a decade of experience in the industry with previous work in the Security Operations Center (SOC) for a major domain registrar and web hosting provider. Scott is a current CISSP and actively maintains his GIAC GWAPT Web Application Penetration Tester certification.
Interests outside of work: Scott enjoys spending time with his family, camping, fishing and being outdoors. He also enjoys finding ways to break web applications and home renovation projects.
Related articles
Complying with the Monetary Authority of Singapore’s Cloud Advisory: How Tenable Can Help
The Monetary Authority of Singapore’s cloud advisory, part of its 2021 Technology Risk Management Guidelines, advises financial institutions to move beyond siloed monitoring to adopt a continuous, enterprise-wide approach. These firms must undergo annual audits. Here’s how Tenable can help.
7 Questions to Unmask “Single Agent” Exposure Management Money Pits
Many EDR vendors are retrofitting their tools and slapping an “exposure management” label on them. Don’t be fooled. These offerings often conceal unexpected costs and create dangerous blind spots. Use these seven questions to find an exposure management platform that delivers real value that scales.
Security for AI: How Shadow AI, Platform Risks, and Data Leakage Leave Your Organization Exposed
Your employees are using AI whether you’ve sanctioned it or not. And even if you’ve carefully vetted and approved an enterprise-grade AI platform, you’re still at risk of attacks and data leakage.
- Exposure Management
- Vulnerability Management
Contact our sales team