CVE-2025-40598

Exploitation likely. EPSS gives it a 64% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.16.1Medium EPSS percentile99th64% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2025-07-23Updated 2025-08-07Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run an SMA 210, SMA 410, or SMA 500v and record its current firmware version.
Confirm whether its web management interface is reachable from the internet.
Upgrade SMA 210, SMA 410, and SMA 500v firmware to 10.2.2.1-90sv or later.
Until upgraded, limit web-interface access to trusted networks and avoid opening unsolicited device-management links.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.

In plain language

Written by AI from the record

SMA100 series web interfaces have a browser-based flaw that can trick a user into running an attacker’s code; update affected SMA 210, SMA 410, and SMA 500v devices.

Reflected XSS in the SMA100 series web interface allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim’s browser after the victim follows a crafted request.

If you're affected

Browser session theft
Unauthorized interface actions
Administrator account misuse

What is it

This flaw can make a legitimate device-management page run code supplied by an attacker when someone opens a specially made link. It is like a fake instruction sheet being slipped into your office binder: the binder is real, but following the inserted instruction can cause harmful actions under the reader’s access.

Who is affected

This matters to you if you run an SMA100 series appliance, especially an SMA 210, SMA 410, or SMA 500v. An attacker does not need a login, but must get someone to open a crafted request; exposure is greatest when the web interface is reachable from the internet.

How urgent is it

No active attacks are confirmed, and this issue is not listed in the government’s catalog of vulnerabilities known to be exploited. Treat this as planned-but-prompt maintenance: update the affected devices and reduce public access to their management interface while the update is pending.

What to do — in detail

Confirm the appliance model, installed firmware, and whether the management web interface is exposed to the internet. For SMA 210, SMA 410, and SMA 500v, target firmware 10.2.2.1-90sv or later; the findings do not provide a fixed version for SMA 100, so obtain the applicable remediation from the vendor before changing it.

Schedule the firmware upgrade under your normal change process and verify that administrator access and device functions work afterward. No breaking-change information was provided. If patching is delayed, restrict the management interface to trusted administrator networks or a private access path, and warn administrators not to follow unsolicited links to the interface.

There is no CISA KEV due date because this CVE is not listed in KEV. Review web-interface and administrator activity for unexpected requests or changes around the time of the upgrade.

Technical context

CVSS v3.1: 6.1 (Medium), with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The weakness is CWE-79 reflected cross-site scripting in the SMA100 series web interface: an unauthenticated remote attacker can induce JavaScript execution in a victim browser, requiring user interaction. No public exploit code is on record and CISA KEV does not list this CVE. EPSS predicts 50.7% likelihood (99th percentile) and is rising; this is predictive risk, not evidence of active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

64% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 417 days, from the signal feeds we watch.

2026-09-13EPSS band changemoderate → highepss band change
2026-09-07EPSS band changehigh → moderate
2026-09-06EPSS band changehigh → moderateepss band change
2026-06-25OpenVAS check added
2026-06-22EPSS band changelow → high
2025-08-07Patch availablerecord updated

Affected products

SonicWallcommercial · US

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Scored 6.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact