SonicWall has issued a security advisory (SNWLID-2025-0019) regarding a local privilege escalation vulnerability in the SMA1000 appliance management console (AMC). Tracked as CVE-2025-40602, the vulnerability becomes highly dangerous when chained with CVE-2025-23006, enabling full system compromise with root-level remote code execution.
Severity: High
Vulnerability Details
- CVE ID: CVE-2025-40602
- CVSS Score: 6.6
- CWE: CWE-862 (Missing Authorization), CWE-250 (Execution with Unnecessary Privileges)
- Description:
- The vulnerability results from insufficient authorization in the AMC (Appliance Management Console) of SonicWall SMA1000 appliances.
- A local attacker with limited privileges could exploit the flaw to escalate privileges to administrative or root levels.
- While exploitation requires existing access to the system, when combined with CVE-2025-23006, an attacker could bypass authentication and execute arbitrary code remotely, resulting in full system takeover.
Affected Products
- SMA1000: 12.4.3-03093 (platform-hotfix) and earlier versions; 12.5.0-02002 (platform-hotfix) and earlier versions
Exploit Scenarios
- Standalone exploitation: Requires prior local account access (insider threat or lateral movement).
- Chained exploitation:
- CVE-2025-23006 (RCE, CVSS 9.8) → Gain initial access
- CVE-2025-40602 → Escalate privileges to root
- This chained attack can yield unauthenticated remote code execution with root privileges on unpatched SMA1000 systems.
Recommendations
- Immediately upgrade affected SonicWall SMA1000 appliances to:
12.4.3-03245 (platform-hotfix) or later
12.5.0-02283 (platform-hotfix) or later - Verify that CVE-2025-23006 is patched – it was remediated in build 12.4.3-02854 or higher.
- Restrict access to the Appliance Management Console (AMC) to trusted administrative networks or VPNs only.
- Disable AMC and SSH access from the public internet to reduce external exposure.
- Review all local user accounts and privileges on SMA devices.
- Revoke unnecessary administrative accounts and ensure least-privilege principles are applied.
- Implement multi-factor authentication (MFA) for administrative logins wherever possible.
Source:
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.