Pre-authentication Deserialization Vulnerability in SMA1000 Appliance Management Console by SonicWall
CVE-2025-23006

9.8CRITICAL

Key Information:

Vendor
Sonicwall
Status
Sma1000
Vendor
CVE Published:
23 January 2025

Badges

📈 Trended📈 Score: 3,760💰 Ransomware👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2025-23006?

CVE-2025-23006 is a vulnerability associated with the SMA1000 Appliance Management Console by SonicWall. This product is designed to manage secure access and facilitate remote connectivity for organizations. The vulnerability is characterized by pre-authentication deserialization of untrusted data, which could allow a remote attacker, without prior authentication, to execute arbitrary operating system commands. The implications of this vulnerability could severely compromise an organization’s security posture, leading to unauthorized access and potential manipulation of critical systems.

Technical Details

The vulnerability arises from improper handling of deserialization processes before authentication takes place. Specifically, if exploited under the right conditions, it can allow an attacker to inject malicious payloads, leading to arbitrary command execution on the operating system level. This could be triggered without any legitimate credentials, highlighting a significant security loophole that can be leveraged by malicious actors operating within the network.

Potential Impact of CVE-2025-23006

  1. Unauthorized Access: Exploitation of this vulnerability could result in unauthorized users gaining control over the SMA1000 appliance, leading to compromised security and potential exposure of sensitive data.

  2. System Compromise: The ability to execute arbitrary commands remotely can lead to the manipulation of system configurations, installation of malware, or even full system takeover, thereby disrupting business operations.

  3. Increased Risk of Ransomware Attacks: Since the vulnerability allows command execution without authentication, it raises the risk of being targeted by ransomware groups that could utilize this flaw to infiltrate systems, encrypt data, and demand ransom for recovery.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

SMA1000 Linux 12.4.3-02804 (platform-hotfix) and earlier versions.

News Articles

favicon imageSecurityWeek

SonicWall Confirms Exploitation of New SMA Zero-Day

SonicWall has confirmed that an SMA 1000 zero-day tracked as CVE-2025-23006 has been exploited in the wild.

1 week ago

favicon imageCybersecurityNews

CISA Warns of SonicWall 0-day RCE Vulnerability Exploited in Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical vulnerability, CVE-2025-23006, affecting SonicWall’s Secure Mobile Access (SMA) 1000 series appliances.

1 week ago

favicon imageHelp Net Security

Week in review: 48k Fortinet firewalls open to attack, attackers "vishing" orgs via Microsoft Teams - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 48,000+ internet-facing Fortinet firewalls still open to

2 weeks ago

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📈

    Vulnerability started trending

  • 🦅

    CISA Reported

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by SecurityWeek

  • Vulnerability published

  • Vulnerability Reserved

.