Sonic Wall Fixes Actively Exploited CVE-2025-40602 in SMA 100 Appliances
Summary: SonicWall released fixes for CVE-2025-40602, a local privilege escalation flaw (CVSS 6.6) caused by insufficient authorization in the SMA 100 series appliance management console, which the company said has been actively exploited. SonicWall reported the flaw was leveraged together with CVE-2025-23006 (CVSS 9.8), patched in version 12.4.3-02854 in late January 2025, to achieve unauthenticated remote code execution with root privileges.
Bottom line: CISA added CVE-2025-40602 to its KEV catalog and requires Federal Civilian Executive Branch agencies to apply fixes by December 24, 2025, while Google's Threat Intelligence Group has separately tracked UNC6148 targeting fully-patched end-of-life SMA 100 devices to drop the OVERSTEP backdoor.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-23006CVE-2025-40602
- Related
- ⚡ Weekly Recap: Firewall Exploits, AI Data Theft, Android Hacks, APT Attacks, Insider Leaks & More Cyber Risks ·CVE-2025-40602: Sonic Wall SMA1000 Missing Authorization Vulnerability Known Exploited Vulnerabilities · Dec 17, 2025CVE-2025-23006: Sonic Wall SMA1000 Appliances Deserialization Vulnerability Known Exploited Vulnerabilities · Jan 24, 2025