Live › vulnerability › CVE-2025-40602
Go to dashboardSonicWall SMA1000 appliances have a missing authorization check in the appliance management console (AMC) that lets an attacker escalate privileges. CISA lists it as actively exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SonicWall SMA1000 appliance | vendor | – | – |
| sonicwall sma6200 firmware | vendor | < 12.4.3-03245 | 12.4.3-03245 |
| sonicwall sma6200 firmware | vendor | >= 12.5.0, < 12.5.0-02283 | 12.5.0-02283 |
| sonicwall sma6210 firmware | vendor | < 12.4.3-03245 | 12.4.3-03245 |
| sonicwall sma6210 firmware | vendor | >= 12.5.0, < 12.5.0-02283 | 12.5.0-02283 |
| sonicwall sma7200 firmware | vendor | < 12.4.3-03245 | 12.4.3-03245 |
| sonicwall sma7200 firmware | vendor | >= 12.5.0, < 12.5.0-02283 | 12.5.0-02283 |
| sonicwall sma7210 firmware | vendor | < 12.4.3-03245 | 12.4.3-03245 |
| sonicwall sma7210 firmware | vendor | >= 12.5.0, < 12.5.0-02283 | 12.5.0-02283 |
| sonicwall sma8200v | vendor | < 12.4.3-03245 | 12.4.3-03245 |
| sonicwall sma8200v | vendor | >= 12.5.0, < 12.5.0-02283 | 12.5.0-02283 |
Unknown from the sources.
Apply the mitigation from the SonicWall vendor advisory; if none is available, discontinue use of the product per CISA guidance.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
This page as .md · .json · in your agent: get_signal("CVE-2025-40602")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.