Zero-Day Warning: Hackers Chain SonicWall SMA1000 Flaws for Unauthenticated Root RCE

According to SonicWall’s advisory, the SMA1000 series remote access gateways are affected by a vulnerability tracked as CVE-2025-40602, which is being weaponised in combination with CVE-2025-23006 to achieve unauthenticated remote code execution with root privileges. By chaining these exploits, attackers can bypass authentication and then elevate privileges to root, effectively gaining full control over affected networks.

The flaw affects SMA1000 devices running firmware versions 12.4.3-03093 and earlier or 12.5.0-02002 and earlier. SonicWall has released platform hotfixes to address the issue, specifically builds 12.4.3-03245 and 12.5.0-02283. For organisations that cannot take systems offline, the advisory recommends locking down the management interface by disabling SSL VPN management interface (AMC) and SSH access from the public internet, and restricting access to VPN tunnels or to specific internal IP addresses only.

The warnings come amid reports that the vulnerability is being exploited in active attack chains, underscoring the urgency of applying fixes.