CVE-2025-32821

—

CVSS 3.1

7.2 high

EPSS

19%p97

Published

May 7, 2025 (May 7, 2025)

Modified

Jun 17, 2026

Description

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell command arguments to upload a file on the appliance.

Vendors: sonicwall
Products: sma 100 firmware, sma 200 firmware, sma 210 firmware, sma 400 firmware, sma 410 firmware, sma 500v firmware
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (19.4%)

In the news5 stories

SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root

The Hacker NewsMay 8, 13:56 UTC · May 8, 2025Vulnerability in the wildCVE-2025-32819 CVE-2025-32820 CVE-2025-32821+3 CVEs

Yet another SonicWall SMA100 vulnerability exploited in the wild (CVE-2025-32819)

Help Net SecurityMay 8, 00:00 UTC · May 8, 2025Exploit / PoC in the wildCVE-2025-32819 CVE-2025-32820 CVE-2025-32821

CVE-2025-32821

In the news5 stories

⚡ Weekly Recap: Zero-Day Exploits, Developer Malware, IoT Botnets, and AI

SonicWall customers confront resurgence of actively exploited vulnerabilities

SonicWall fixed SMA 100 flaws that could be chained to execute arbitrary code

SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root

Yet another SonicWall SMA100 vulnerability exploited in the wild (CVE-2025-32819)