{"id":201,"created_when":"2025-01-22T12:45:16Z","created_by":"arun","updated_when":"2025-01-22T12:45:16Z","updated_by":"arun","advisory_id":"SNWLID-2025-0002","title":"SMA1000 Pre-Authentication Remote Command Execution Vulnerability","published_when":"2025-01-22T12:45:16Z","last_updated_when":"2025-02-10T11:33:20Z","impact":"critical","cvss":"9.8","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-502","cve":"CVE-2025-23006","cpe":"","summary":"<p>Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.</p><p>IMPORTANT: SonicWall PSIRT has been notified of possible active exploitation of the referenced vulnerability by threat actors. We strongly advises users of the SMA1000 product to upgrade to the hotfix release version to address the vulnerability.</p><p>Please note that SonicWall Firewall and SMA 100 series products are not affected by this vulnerability.</p>","is_workaround_available":true,"workaround":"To minimize the potential impact of the vulnerability, please ensure that you restrict access to trusted sources for the Appliance Management Console (AMC) and Central Management Console (CMC). Refer to the <a href=\"https://www.sonicwall.com/techdocs/pdf/sma_1000-12-4-admin_guide.pdf#page=653\" target=\"_blank\">SMA1000 Administration Guide,</a>&nbsp;section - Best Practices for Securing the Appliance.","detail":"<p>Product Notice:&nbsp;<a href=\"https://www.sonicwall.com/support/knowledge-base/sma-1000-product-notice\">https://www.sonicwall.com/support/knowledge-base/sma-1000-product-notice</a><a href=\"https://www.sonicwall.com/support/knowledge-base/sma-1000-product-notice\"></a></p><p><b>Indicators of Compromise (IoCs)</b></p><p><u>The following are possible IoCs:</u></p><p>See AMC &gt; Management message log</p><p>Warning: Source AMC</p><ul><li>- Caught exception while trying to setup the ApplyDialogPreparer: java.lang.NullPointerException</li><li>- java.lang.NullPointerException: null</li><li><span style=\"white-space: normal;\">- Caught exception while trying to deserialization: java.lang.RuntimeException: InvocationTargetException: java.lang.reflect.InvocationTargetException</span></li><li>- java.lang.RuntimeException: InvocationTargetException: java.lang.reflect.InvocationTargetException</li></ul>","affected_products":"Version 12.4.3-02804 (platform-hotfix) and earlier versions.","fixed_software":"Version 12.4.3-02854 (platform-hotfix) and higher versions.","credits":"Microsoft Threat Intelligence Center (MSTIC)","revision_history":"<ul class=\"summary-detail-item-label-group\">\r\n    <li class=\"summary-detail-label\">Version</li>\r\n    <li class=\"summary-detail-item\"><p>1.0</p></li>\r\n</ul>\r\n<ul class=\"summary-detail-item-label-group\">\r\n    <li class=\"summary-detail-label\">Date</li>\r\n    <li class=\"summary-detail-item\">\r\n        <p>22-Jan-2025</p>\r\n    </li>\r\n</ul>\r\n<ul class=\"summary-detail-item-label-group\">\r\n    <li class=\"summary-detail-label\">Description</li>\r\n    <li class=\"summary-detail-item\"><p>Initial Release.</p></li><p>---------------------------------------</p></ul>\r\n<ul class=\"summary-detail-item-label-group\">\r\n    <li class=\"summary-detail-label\">Version</li>\r\n    <li class=\"summary-detail-item\"><p>1.1</p></li>\r\n</ul>\r\n<ul class=\"summary-detail-item-label-group\">\r\n    <li class=\"summary-detail-label\">Date</li>\r\n    <li class=\"summary-detail-item\">\r\n        <p>23-Jan-2025</p>\r\n    </li>\r\n</ul>\r\n<ul class=\"summary-detail-item-label-group\">\r\n    <li class=\"summary-detail-label\">Description</li>\r\n    <li class=\"summary-detail-item\"><p>Comments Section: Added product notice link.</p></li><p>---------------------------------------</p></ul>\r\n<ul class=\"summary-detail-item-label-group\">\r\n    <li class=\"summary-detail-label\">Version</li>\r\n    <li class=\"summary-detail-item\"><p>1.2</p></li>\r\n</ul>\r\n<ul class=\"summary-detail-item-label-group\">\r\n    <li class=\"summary-detail-label\">Date</li>\r\n    <li class=\"summary-detail-item\">\r\n        <p>10-Feb-2025</p>\r\n    </li>\r\n</ul>\r\n<ul class=\"summary-detail-item-label-group\">\r\n    <li class=\"summary-detail-label\">Description</li>\r\n    <li class=\"summary-detail-item\"><p>Comments section updated: Added Indicators of Compromise (IoCs).</p></li>\r\n</ul>","references":"","vuln_status":"Applicable","status":"published","is_published":true,"patterns":[{"pattern":"^(?:(?:[0-9]|1[0-1])\\.\\d+\\.\\d+-\\d+|12\\.[0-3]\\.\\d+-\\d+|12\\.4\\.[0-2]-\\d+|12\\.4\\.3-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|1\\d{3}|2[0-7]\\d{2}|280[0-3])|12\\.4\\.3-02804)$","name":"Central Management Server (CMS)","id":16},{"pattern":"^(?:(?:[0-9]|1[0-1])\\.\\d+\\.\\d+-\\d+|12\\.[0-3]\\.\\d+-\\d+|12\\.4\\.[0-2]-\\d+|12\\.4\\.3-(?:[0-9]|[1-9]\\d|[1-9]\\d{2}|1\\d{3}|2[0-7]\\d{2}|280[0-3])|12\\.4\\.3-02804)$","name":"Secure Mobile Access (SMA) 1000 Series","id":5}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5},{"name":"Central Management Server (CMS)","id":16}]}