SonicWall Edge Access Devices Hit by Zero-Day Attacks

SonicWall Edge Access Devices are being targeted by zero-day attacks that chain a new local privilege escalation with a previously disclosed critical flaw affecting SMA1000 appliances. CVE-2025-40602 is a medium-severity local privilege escalation (CVSS 6.6) in the SMA1000 appliance management console, according to SonicWall's advisory, and exploitation in the wild appears to require either an unpatched CVE-2025-23006 (CVSS 9.8) or existing local system access.

The vendor says the zero-day has been used in chain attacks alongside CVE-2025-23006, which also affects SMA100 devices, with attacks dating back to January. Mitigations include applying hotfixes in version 12.4.3-03245 and higher or 12.5.0-02283 and higher, restricting AMC access to VPN or administrator IPs, and disabling the SSL VPN management interface in AMC and SSH from the public Internet, according to SonicWall.

The attacks on CVE-2025-40602 are not the only threat SonicWall customers faced this year, with earlier events including a cloud backup service breach and a wave of Akira ransomware activity that involved an older vulnerability, CVE-2024-40766. Researchers credited with discovery of CVE-2025-40602 are Clément Lecigne and Zander Work of Google's Threat Intelligence Group.