9.8

CVE-2025-23006

Warning

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.

Data is provided by the National Vulnerability Database (NVD)
Sonicwall ≫ Sma8200v Version < 12.4.3-02854
Sonicwall ≫ Sma6200 Firmware Version < 12.4.3-02854
   Sonicwall ≫ Sma6200 Version-
Sonicwall ≫ Sma6210 Firmware Version < 12.4.3-02854
   Sonicwall ≫ Sma6210 Version-
Sonicwall ≫ Sma7200 Firmware Version < 12.4.3-02854
   Sonicwall ≫ Sma7200 Version-
Sonicwall ≫ Sma7210 Firmware Version < 12.4.3-02854
   Sonicwall ≫ Sma7210 Version-
Sonicwall ≫ Sra Ex6000 Firmware Version <= 12.4.3-02804
   Sonicwall ≫ Sra Ex6000 Version-
Sonicwall ≫ Sra Ex7000 Firmware Version <= 12.4.3-02804
   Sonicwall ≫ Sra Ex7000 Version-
Sonicwall ≫ Sra Ex9000 Firmware Version <= 12.4.3-02804
   Sonicwall ≫ Sra Ex9000 Version-

24.01.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

SonicWall SMA1000 Appliances Deserialization Vulnerability

Vulnerability

SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.

Description

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 58.19% 0.981
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.