SonicWall Patches Exploited SMA 1000 Zero-Day

SonicWall has warned that threat actors have been exploiting a zero-day in the SMA 1000 appliance management console (AMC), a vulnerability tracked as CVE-2025-40602 with a CVSS of 6.6, disclosed on 18 December 2025.

The company says the flaw is a local privilege escalation rooted in insufficient authorization and was discovered by Google Threat Intelligence Group researchers; it was reported to be leveraged in combination with CVE-2025-23006 (CVSS 9.8) to achieve unauthenticated remote code execution with root privileges. CVE-2025-23006 was previously disclosed as a zero-day and patched in SMA 1000 versions 12.4.3-02854; the fresh zero-day was fixed in versions 12.4.3-03245 and 12.5.0-02283.

The US Cybersecurity and Infrastructure Security Agency has added CVE-2025-40602 to its Known Exploited Vulnerabilities list and urged patching, with federal agencies given one week to address the flaw under KEV guidance. Mitigations include updating SMA 1000 appliances to the latest hotfix or applying recommended restrictions, such as limiting SSH access to the AMC via VPN or approved admin IPs and disabling the SSL VPN management interface and SSH access from the public internet. According to SonicWall, the vulnerability does not impact SSL-VPN running on SonicWall firewall products.