CVE-2025-40602

Exploited in the wild. In CISA KEV since 2025‑12‑17. A vendor fix is available.

CVSS 3.16.6Medium EPSS percentile86th2.8% chance in 30 days CISA KEVListedsince 2025-12-17, due 2025-12-24
No public exploit known FixVendor fixNo build named by the sources

Published 2025-12-18Updated 2025-12-19Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which SonicWall appliance model you run (SMA1000 / SMA6200 / SMA6210 / SMA7200 / SMA7210 / SMA8200v) and your current AMC firmware version.
If your device is on one of the affected firmware families, plan to upgrade to the fixed firmware: 12.4.3-03245.
If you cannot upgrade before the due date, follow SonicWall’s mitigation guidance from the vendor advisory (and consider disabling or tightly restricting access to the AMC web management interface from untrusted networks).
After upgrading, verify the firmware is actually running (not just downloaded) and review admin activity/logs for any recent suspicious management-console actions.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

In plain language

Written by AI from the record

If you run a SonicWall SMA1000 appliance (including SMA6200/SMA6210/SMA7200/SMA7210/SMA8200v) and an attacker already has a high-privilege login, this SMA management console flaw can let them take complete control of the device—this is serious and you should fix it.

CVE-2025-40602 is a permission-check failure (CWE-250/CWE-862) in the SonicWall SMA1000 Appliance Management Console (AMC) that allows an authenticated high-privilege admin to bypass authorization and escalate to complete device control via network access to the web management interface; it is listed in CISA KEV.

If you're affected

Full appliance takeover
Backdoor via changed settings
Access to all protected data
Service disruption and outages

What is it

Think of the SMA1000 as a secure “control room” for your network connections, and the AMC as the room’s admin console. This bug lets a highly privileged insider (someone who already has a strong admin login) use the console to escape permission limits and seize full control of the appliance—like turning all locks on the building into their own keys. Because the attacker can change settings and access what the device protects, it’s a direct risk to your business network and data.

Who is affected

This matters if you operate a SonicWall SMA1000 appliance (including SMA6200, SMA6210, SMA7200, SMA7210, and SMA8200v) and you have the Appliance Management Console (AMC) exposed for administration. It is a risk only when an attacker can reach the AMC and has an authenticated high-privilege admin session/ability to act as such (the vulnerability requires high privileges). The reachability path is the web-based management interface over the network, and additional external exposure is not the only requirement—high admin access is.

How urgent is it

This is RED because it’s confirmed for action by CISA KEV and an advanced actor (UNC5221) has been associated with exploitation activity. The flaw lets an authenticated high-privilege admin bypass authorization and fully control the appliance, so it’s not just a theoretical issue. Act immediately to upgrade to the fixed firmware and apply SonicWall’s required mitigations if you cannot upgrade by the CISA due date.

What to do — in detail

Confirm exposure on your side
- Identify your SonicWall model(s): SMA1000 / SMA6200 / SMA6210 / SMA7200 / SMA7210 / SMA8200v.
- Identify the currently running AMC/SMA firmware version.
- Determine how the AMC web management interface is reachable (for example, whether it is accessible from the internet, VPN-only, or limited internal networks).
Determine whether your version is affected
- The known fixed version for the listed affected families is 12.4.3-03245.
- If you are not already on 12.4.3-03245 for the applicable models (SMA6200, SMA6210, SMA7200, SMA7210, SMA8200v), you should treat your device as unpatched.
Upgrade to the fixed firmware (preferred)
- Upgrade SMA6200/SMA6210/SMA7200/SMA7210/SMA8200v to fixed firmware 12.4.3-03245.
- After the upgrade, validate that the device is actually running 12.4.3-03245 (not only that the file was applied).
If you cannot upgrade immediately
- Apply SonicWall’s mitigation guidance from their PSIRT advisory (follow vendor instructions as stated in the KEV entry).
- Tighten access to the AMC web management interface so it’s reachable only from trusted admin networks/management paths.
- If mitigations are not available or cannot be applied, CISA’s KEV guidance indicates discontinuing use of the product may be required.
Post-upgrade verification and monitoring
- Review AMC/admin-related logs around the time of any recent admin changes (look for unexpected configuration changes).
- Confirm there are no ongoing signs of unauthorized management actions (for example, newly created/changed settings inconsistent with your operations).
KEV deadline
- CISA KEV remediation due date for this issue is 2025-12-24.

Technical context

CVE-2025-40602 is a permission/authorization weakness in the SonicWall SMA1000 Appliance Management Console (AMC) (CWE-250: Permission Issues; CWE-862: Missing Authorization), where an authenticated high-privilege administrator can bypass restrictions and escalate to complete control over the device. The attack is triggered via network-based interactions with the web-based management interface, but the vulnerability requires high-privilege authenticated access; it is not indicated as requiring additional user interaction.

Status/exploitation: This CVE is listed in CISA KEV (added 2025-12-17) with a remediation due date of 2025-12-24, meaning it is prioritized for action. The findings also associate exploitation with actor UNC5221. No public exploit code was found in the provided sources.

Fix: The fixed firmware version for SMA6200, SMA6210, SMA7200, SMA7210, and SMA8200v is 12.4.3-03245.

Risk likelihood note: EPSS was reported as 2.1% with a flat trend, but KEV confirmation takes precedence for urgency in this assessment.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS86th

CISA KEV

Listed as exploited in the wild since 2025-12-17.

US federal agencies must remediate by 2025-12-24.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

2.8% chance of exploitation activity in the next 30 days, which ranks it in the 86th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 265 days, from the signal feeds we watch.

2026-09-08Analysis publishedSonicWall's SMA1000 Just Had Its Third Zero-Day SSRF Pair in Nine Months
2026-06-25OpenVAS check added
2025-12-19Patch availablerecord updated
2025-12-18Publishedweakness classified, att&ck mapped
2025-12-17Added to CISA KEV

Affected products

SonicWallcommercial · US

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Scored 6.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable