Live › vulnerability › CVE-2025-23006
Go to dashboardSonicWall SMA1000 appliances have a deserialization flaw in the Appliance Management Console and Central Management Console that lets a remote, unauthenticated attacker run arbitrary OS commands. CISA lists it as actively exploited in the wild, with ransomware use noted in the sources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SonicWall SMA1000 Appliances | vendor | – | – |
| sonicwall sma8200v | vendor | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall sma6200 firmware | vendor | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall sma6210 firmware | vendor | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall sma7200 firmware | vendor | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall sma7210 firmware | vendor | < 12.4.3-02854 | 12.4.3-02854 |
| sonicwall sra ex6000 firmware | vendor | <= 12.4.3-02804 | – |
| sonicwall sra ex7000 firmware | vendor | <= 12.4.3-02804 | – |
| sonicwall sra ex9000 firmware | vendor | <= 12.4.3-02804 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2025-23006")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.