SonicWall warns of actively exploited flaw in SMA 100 AMC

SonicWall has urged customers to patch a flaw tracked as CVE-2025-40602 in the SMA1000 Appliance Management Console (AMC), a local privilege escalation vulnerability that was exploited as a zero-day in attacks in the wild. According to SonicWall PSIRT, the flaw stems from insufficient authorisation in the SMA1000 AMC, and the company notes that SonicWall Firewall products are not affected by this vulnerability.

The advisory also states that the vulnerability was chained with CVE-2025-23006 (CVSS 9.8) to achieve unauthenticated remote code execution with root privileges, though SonicWall has not disclosed details about the attacks or the attackers’ motivations. SonicWall addressed CVE-2025-23006 in January 2025 with version 12.4.3-02854 (platform-hotfix), and the U.S.

Cybersecurity and Infrastructure Security Agency subsequently added the SMA1000 AMC/CMC vulnerability to its Known Exploited Vulnerabilities catalog in late January. Users are strongly advised to upgrade to the latest hotfix release to mitigate the issue.