SonicWall warns of hackers exploiting SMA zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-23006 | Unauthenticated Deserialization RCE in SonicWall SMA1000 Appliances CVE-2025-23006 is a deserialization of untrusted data flaw (CWE-502) in the Appliance Management Console (AMC) and Central Management Console (CMC) of SonicWall SMA1000 secure-access appliances. A remote, unauthenticated attacker who can reach a vulnerable console can submit crafted serialized data that, when processed, executes arbitrary operating-system commands on the appliance. Successful exploitation yields OS-level command execution, which is enough to fully compromise the appliance, pivot into the networks it protects, or stage ransomware. Any organization running a SonicWall SMA1000 appliance whose AMC or CMC is reachable — including management consoles exposed to the internet or to shared management networks — is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-01-24 with known ransomware use, and EPSS assigns a 23.4% probability of exploitation within 30 days (98th percentile), although no public proof-of-concept is known and a CVSS score has not yet been published. Do: Apply SonicWall's fix or vendor-specified mitigations immediately, per CISA's KEV required action; the available data does not state fixed version numbers, so use SonicWall's advisory to identify the correct firmware. Until patched, restrict AMC/CMC access to trusted management networks and remove any direct internet exposure of the consoles. Because ransomware use is known, hunt for indicators of compromise on internet-reachable SMA1000 appliances, including unexpected processes, new accounts, and unusual outbound connections. | 9.8 | 23% | KEV ransomware |
| largeon the order of tens of thousands of SMA1000-series appliance deployments, with likely thousands of management consoles internet-exposed |
Full article368 words · extracted from therecord.media · click to collapse
A vulnerability affecting a popular line of VPN appliances from SonicWall is causing alarm following reports that hackers are using it in attacks. The cybersecurity company published an advisory on Wednesday warning the vulnerability impacts its Secure Mobile Access (SMA) 1000 Series product, which many companies use to provide employees with VPN access to corporate networks. “[The SonicWall security team] has been notified of possible active exploitation of the referenced vulnerability by threat actors,” the company said, noting that it was given a 9.8 severity rating out of 10. “We strongly advise users of the SMA1000 product to upgrade to the hotfix release version to address the vulnerability.” On Friday, the Cybersecurity and Infrastructure Security Agency released its own warning that the bug is being exploited, giving civilian agencies until February 14 to patch it. Microsoft’s security team, which discovered the vulnerability and reported it to SonicWall, said on Friday that it is imperative for users to download the update and patch the bug. These types of devices — appliances that serve as gateways for secure remote access — are an attractive target for attackers, said Boris Cipot of the cybersecurity company Black Duck. Scott Caveza, staff research engineer at Tenable, noted that SonicWall devices have been targeted frequently in the past, with several bugs being featured on the CISA’s list of exploited bugs. “Specifically, the SMA product line has been targeted in the past by ransomware groups, as well as being featured in the Top Routinely Exploited Vulnerabilities list co-authored by multiple United States and International Agencies,” he said. Germany’s cybersecurity agency released its own warning about the vulnerability on Thursday. Correction: A previous version of this story incorrectly stated that more than 2,000 SonicWall devices were vulnerable to CVE-2025-23006, based on data from Shodan. Less than 100 appliances had the management portal exposed publicly prior to the release of the vulnerability.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/sonicwall-devices-exposed-zero-day