CVE-2025-40602
Published: December 17, 2025
Official Description
SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.
CISA KEV Advisory
SonicWall SMA1000 Missing Authorization Vulnerability
SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
Risk Analysis
SonicWall SMA1000 devices have a missing authorization vulnerability that could lead to privilege escalation within the appliance management console (AMC). While rated medium severity with a CVSS score of 6.6, its inclusion in CISA's KEV catalog indicates confirmed exploitation, making it an urgent threat despite a low EPSS score of 0.00309.
This vulnerability has been actively exploited in the wild, as confirmed by its presence in CISA's KEV catalog. It is remotely exploitable with high complexity.
Administrators of SonicWall SMA1000 devices should apply the latest security updates to address this missing authorization vulnerability and prevent privilege escalation.
Technical Analysis
CVE-2025-40602 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 6.6.
CISA has added CVE-2025-40602 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-40602 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1