6.6

CVE-2025-40602

Warnung
Medienbericht
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sonicwall ≫ Sma6200 Firmware Version < 12.4.3-03245
   Sonicwall ≫ Sma6200 Version -
Sonicwall ≫ Sma6200 Firmware Version >= 12.5.0 < 12.5.0-02283
   Sonicwall ≫ Sma6200 Version -
Sonicwall ≫ Sma6210 Firmware Version < 12.4.3-03245
   Sonicwall ≫ Sma6210 Version -
Sonicwall ≫ Sma6210 Firmware Version >= 12.5.0 < 12.5.0-02283
   Sonicwall ≫ Sma6210 Version -
Sonicwall ≫ Sma7200 Firmware Version < 12.4.3-03245
   Sonicwall ≫ Sma7200 Version -
Sonicwall ≫ Sma7200 Firmware Version >= 12.5.0 < 12.5.0-02283
   Sonicwall ≫ Sma7200 Version -
Sonicwall ≫ Sma7210 Firmware Version < 12.4.3-03245
   Sonicwall ≫ Sma7210 Version -
Sonicwall ≫ Sma7210 Firmware Version >= 12.5.0 < 12.5.0-02283
   Sonicwall ≫ Sma7210 Version -
Sonicwall ≫ Sma8200v Version < 12.4.3-03245
Sonicwall ≫ Sma8200v Version >= 12.5.0 < 12.5.0-02283
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login

17.12.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

SonicWall SMA1000 Missing Authorization Vulnerability

Schwachstelle

SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.11% 0.802
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 6.6 0.7 5.9
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-250 Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
02.09.2026 08:54
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
10.08.2026 16:53
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40602
US Government Resource