CVE-2025-40602
MediumActively exploited (CISA KEV)
Description
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
SeverityMedium
CVSS6.6
Exploit probability—
Product
SonicWall SMA1000 appliance
PublishedDec 18, 2025
First seenDec 18, 2025
Added to KEVDec 17, 2025
Weakness typeCWE-862Missing authorizationCWE-250CWE-250
How to fix
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
CISA due date: Dec 24, 2025Update
- sonicwall sma6200_firmware12.4.3-03245, 12.5.0-02283 or later
- sonicwall sma6210_firmware12.4.3-03245, 12.5.0-02283 or later
- sonicwall sma7200_firmware12.4.3-03245, 12.5.0-02283 or later
- sonicwall sma7210_firmware12.4.3-03245, 12.5.0-02283 or later
- sonicwall sma8200v12.4.3-03245, 12.5.0-02283 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sonicwall sma6200_firmware | v < 12.4.3-03245, 12.5.0 ≤ v < 12.5.0-02283 | 12.4.3-03245, 12.5.0-02283 |
| sonicwall sma6210_firmware | v < 12.4.3-03245, 12.5.0 ≤ v < 12.5.0-02283 | 12.4.3-03245, 12.5.0-02283 |
| sonicwall sma7200_firmware | v < 12.4.3-03245, 12.5.0 ≤ v < 12.5.0-02283 | 12.4.3-03245, 12.5.0-02283 |
| sonicwall sma7210_firmware | v < 12.4.3-03245, 12.5.0 ≤ v < 12.5.0-02283 | 12.4.3-03245, 12.5.0-02283 |
| sonicwall sma8200v | v < 12.4.3-03245, 12.5.0 ≤ v < 12.5.0-02283 | 12.4.3-03245, 12.5.0-02283 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.