SonicWall Issues Emergency Patch to Remove ‘OVERSTEP’ Rootkit Malware on SMA Devices

SonicWall has issued an emergency patch for its Secure Mobile Access SMA 100 Series appliances to remove a rootkit known as OVERSTEP, a threat noted for its persistence on older SMA firmware. The new build, 10.2.2.2-92sv, adds enhanced file checking to detect and remove the hidden components.

SonicWall first published Advisory SNWLID-2025-0015 on 22 September 2025 and marked it critical for SMA 210, SMA 410, and SMA 500v models, with guidance that the risk is significant due to the rootkit’s stealth and remote-control capabilities, as highlighted by the Google Threat Intelligence Group (GTIG).

The advisory does not assign a CVE or CVSS score, but organisations running SMA 100 Series devices on version 10.2.1.15-81sv or earlier are urged to upgrade promptly; the patch also avoids affecting the older SMA1000 Series or SSL-VPN on standard SonicWall firewalls. After upgrading, IT teams should perform a full file system scan and review logs for unauthorized access, while rotating credentials and monitoring post-remediation traffic. The update is designed to harden SMA against kernel-level threats and ensure remediation of any lingering OVERSTEP components.