CVE-2025-32819

PoC —

CVSS 3.1

8.8 high

EPSS

6%p93

Published

May 7, 2025 (May 7, 2025)

Modified

Jun 17, 2026

Description

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.

Vendors: sonicwall
Products: sma 100 firmware, sma 200 firmware, sma 210 firmware, sma 400 firmware, sma 410 firmware, sma 500v firmware
Weakness: CWE-552
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (6.4%)

In the news11 stories

⚡ Weekly Recap: Zero-Day Exploits, Developer Malware, IoT Botnets, and AI

The Hacker NewsJan 20, 09:20 UTC · Jan 20, 2026Exploit / PoC CVE-2025-29824 CVE-2025-2775 CVE-2025-2776+19 CVEs

SonicWall SMA devices persistently infected with stealthy OVERSTEP backdoor and rootkit

Help Net SecurityAug 5, 15:29 UTC · Aug 5, 2025Malware CVE-2021-20035 CVE-2021-20039 CVE-2024-38475+1 CVEs

UNC6148 Backdoors Fully-Patched SonicWall SMA 100 Series Devices with OVERSTEP Rootkit

The Hacker NewsJul 26, 11:34 UTC · Jul 26, 2025Vulnerability CVE-2021-20035 CVE-2021-20038 CVE-2021-20039+2 CVEs

SonicWall customers hit by fresh, ongoing attacks targeting fully patched SMA 100 devices

CyberScoopJul 16, 17:52 UTC · Jul 16, 2025Vulnerability in the wildCVE-2021-20038 CVE-2024-38475 CVE-2021-20035+2 CVEs

Google spots tailored backdoor malware aimed at SonicWall appliances

The RecordJul 16, 15:48 UTC · Jul 16, 2025Malware CVE-2024-38475 CVE-2021-20038 CVE-2021-20035+2 CVEs

Google finds custom backdoor being installed on SonicWall network devices

Ars Technica · SecurityJul 15, 00:00 UTC · Jul 15, 2025Malware in the wildCVE-2021-20038 CVE-2024-38475 CVE-2021-20035+2 CVEs

Week in review: The impact of a CVE-free future on cyber defense, Patch Tuesday forecast

Help Net SecurityMay 11, 00:00 UTC · May 11, 2025Vulnerability in the wildCVE-2025-32819 CVE-2025-27363 CVE-2025-3248+1 CVEs

SonicWall customers confront resurgence of actively exploited vulnerabilities

CyberScoopMay 9, 21:33 UTC · May 9, 2025Vulnerability in the wildCVE-2023-44221 CVE-2021-20035 CVE-2025-23006+7 CVEs

SonicWall fixed SMA 100 flaws that could be chained to execute arbitrary code

Security AffairsMay 9, 07:50 UTC · May 9, 2025Exploit / PoC CVE-2025-32819 CVE-2025-32820 CVE-2025-32821

SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root

The Hacker NewsMay 8, 13:56 UTC · May 8, 2025Vulnerability in the wildCVE-2025-32819 CVE-2025-32820 CVE-2025-32821+3 CVEs

Yet another SonicWall SMA100 vulnerability exploited in the wild (CVE-2025-32819)

Help Net SecurityMay 8, 00:00 UTC · May 8, 2025Exploit / PoC in the wildCVE-2025-32819 CVE-2025-32820 CVE-2025-32821