{"id":216,"created_when":"2025-12-17T13:51:12Z","created_by":"arun","updated_when":"2025-12-18T11:34:30Z","updated_by":"arun","advisory_id":"SNWLID-2025-0019","title":"SonicWall SMA1000 appliance local privilege escalation vulnerability","published_when":"2025-12-17T13:51:12Z","last_updated_when":"2025-12-18T11:34:30Z","impact":"medium","cvss":"6.6","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_version":3.0,"cwe":"CWE-862, CWE-250","cve":"CVE-2025-40602","cpe":"","summary":"

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

\r\n\r\n

Please note that SonicWall Firewall products are not affected by this vulnerability.

","is_workaround_available":true,"workaround":"

Restrict access to Appliance management console (AMC):

","detail":"

IMPORTANT: This vulnerability was reported to be leveraged in combination with CVE-2025-23006 (CVSS score 9.8) to achieve unauthenticated remote code execution with root privileges. CVE-2025-23006 was remediated in build version 12.4.3-02854 (platform-hotfix) and higher versions (released on Jan 22, 2025).

SonicWall PSIRT strongly advises users of the SMA1000 product to upgrade to the latest hotfix release version to address the vulnerability.

Note:

- The only known exploitation paths for CVE-2025-40602 (CVSS 6.6) require either that CVE-2025-23006 (CVSS 9.8) remains unpatched, or that the threat actor already possesses access to a local system account.

- If CVE-2025-23006 has not been patched, the system is already exposed to a critical vulnerability. In this scenario, chaining CVE-2025-40602 does not materially increase the overall risk or attack surface.

","affected_products":"

Affected Product

Affected Version(s)

SMA1000

12.4.3-03093 (platform-hotfix) and earlier versions.

12.5.0-02002 (platform-hotfix) and earlier versions.


Note: This vulnerability does not affect SSL-VPN running on SonicWall firewalls.

\r\n\r\nThe latest platform-hotfix is available for download on mysonicwall.com","fixed_software":"

Fixed Product

Fixed Version(s)

SMA1000

12.4.3-03245 (platform-hotfix) and higher versions.

12.5.0-02283 (platform-hotfix) and higher versions.


","credits":"Clément Lecigne and Zander Work of Google Threat Intelligence Group","revision_history":"\r\n\r\n\r\n\r\n\r\n","references":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002","vuln_status":"Applicable","status":"published","is_published":true,"patterns":[{"pattern":"^(?:(?:12\\.[0-3]\\.\\d{1,1}-\\d{1,5}|12\\.4\\.[0-2]-\\d{5}|12\\.4\\.3-(?:0[0-2]\\d{3}|030[0-8]\\d|0309[0-3]))|(?:12\\.[0-3]\\.\\d{1,1}-\\d{1,5}|12\\.5\\.0-(?:0[0-1]\\d{3}|0200[0-2])))$","name":"Secure Mobile Access (SMA) 1000 Series","id":5}],"vulnerable_products":[{"name":"Secure Mobile Access (SMA) 1000 Series","id":5}]}