Exploited SonicWall zero-day patched (CVE-2025-40602)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-23006 | Unauthenticated Deserialization RCE in SonicWall SMA1000 Appliances | 9.8 | 27% | KEVRansomware | KEV |
| CVE-2025-40602 | Missing Authorization Flaw in SonicWall SMA1000 Appliance Management Console | 6.6 | 3% | KEV | KEV |
From the original article
2 min read at helpnetsecurity.com
SonicWall has patched a local privilege escalation vulnerability (CVE-2025-40602) affecting its Secure Mobile Access (SMA) 1000 appliances and is urging customers to apply the provided hotfix, as the flaw has been exploited by attackers. “This vulnerability was reported to be leveraged in combination with CVE-2025-23006 to achieve unauthenticated remote code execution with root privileges,” the company said.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.