CVE-2025-40602

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

Medium6.6Known exploitedEPSS 2.8%

Published: 18 Dec 2025
Updated: 18 Dec 2025
Reserved: 16 Apr 2025
Assigned by: sonicwall

Description

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as SonicWall SMA1000 Missing Authorization Vulnerability.

Added: 17 Dec 2025
Fix due (US federal): 24 Dec 2025
Used by ransomware: Not known

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable

Scores

CVSS scores of CVE-2025-40602, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	Medium6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	Medium6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 2.8% · top 14% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.6.

Weakness

Affected products

SonicWall · SMA1000
- affected 12.4.3-03093 (platform-hotfix) and earlier versions
- affected 12.5.0-02002 (platform-hotfix) and earlier versions

References (2)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019 (opens in a new tab)vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40602 (opens in a new tab)government-resource

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-40602](https://trackcve.app/badge/CVE-2025-40602.svg)](https://trackcve.app/cve/CVE-2025-40602)

Record last updated 18 Dec 2025, 11:32 UTC.