SonicWall Fixes Actively Exploited CVE-2025-40602 in SMA 100 Appliances

SonicWall has rolled out fixes to address a security flaw in Secure Mobile Access SMA 100 series appliances that it said has been actively exploited in the wild. The vulnerability, tracked as CVE-2025-40602 (CVSS 6.6), concerns a local privilege escalation caused by insufficient authorization in the appliance management console. It affects 12.4.3-03093 (platform-hotfix) and earlier versions, with fixes in 12.4.3-03245, and 12.5.0-02002 (platform-hotfix) and earlier versions, with fixes in 12.5.0-02283.

This vulnerability was reported to be leveraged in combination with CVE-2025-23006 to achieve unauthenticated remote code execution with root privileges, according to SonicWall. Clément Lecigne and Zander Work of Google Threat Intelligence Group have been credited with discovering and reporting CVE-2025-40602, and there are currently no details on the scale of the attacks or who is behind them.

Back in July, Google said it’s tracking a cluster named UNC6148 targeting fully-patched end-of-life SonicWall SMA 100 devices as part of a campaign to drop a backdoor called OVERSTEP.