Executive Summary

SonicWall has disclosed an actively exploited zero-day vulnerability, CVE-2025-40602, affecting its SMA 100 and 1000 series secure access appliances. While rated with a medium CVSS score on its own, this local privilege escalation (LPE) flaw is being chained with a previously patched, critical-rated vulnerability, CVE-2025-23006. This exploit chain allows a remote, unauthenticated attacker to gain full root-level control of a vulnerable appliance. The active, in-the-wild exploitation of this attack chain presents a severe risk to organizations relying on these devices for secure remote access, necessitating immediate patching.

Vulnerability Details

The attack relies on combining two separate vulnerabilities to achieve a full system compromise:

1. CVE-2025-23006: A pre-authentication deserialization vulnerability with a CVSS score of 9.8. This flaw, patched previously, allows an attacker to gain initial access to the device with limited privileges.
2. CVE-2025-40602: A local privilege escalation vulnerability with a CVSS score of 6.6. This zero-day flaw allows an attacker who has already gained initial access (via the first CVE) to elevate their privileges to root.

By chaining these two exploits, a remote attacker can bypass all authentication and gain complete control over the SonicWall SMA appliance.

Affected Systems

The vulnerability chain affects the following SonicWall products:

• SonicWall SMA 100 Series Appliances
• SonicWall SMA 1000 Series Appliances

Administrators of these devices are urged to review SonicWall's security advisories and apply the necessary patches.

Exploitation Status

This exploit chain is confirmed to be actively exploited in the wild. Threat actors are scanning for and attacking unpatched devices. The goal of these attacks is to compromise the secure access appliance, which can then be used to pivot into the internal corporate network, intercept traffic, or steal credentials.

Impact Assessment

The impact of a successful exploit is critical:

• Full Device Takeover: Gaining root access gives the attacker complete control over the appliance. They can alter its configuration, disable security features, and install persistent malware.
• Network Breach: The SMA appliance is a gateway into the corporate network. A compromised device provides a perfect launchpad for attackers to move laterally and attack internal resources.
• Data Interception: Attackers can potentially intercept all traffic passing through the VPN appliance, including sensitive user credentials and confidential data.
• Loss of Secure Access: The integrity of the organization's remote access solution is completely undermined.

Cyber Observables for Detection

Detection Methods

• Patch Verification: The most reliable detection method is to ensure that patches for both CVE-2025-40602 and CVE-2025-23006 are applied. Any device missing either patch should be considered vulnerable.
• Log Analysis: Ingest SMA appliance logs into a SIEM and monitor for signs of exploitation. Look for errors related to deserialization, followed by unexpected privilege escalations or commands being run by the nobody user that then escalate to root.
• Network Traffic Analysis: Monitor for outbound connections from the SMA appliance's management interface to unknown IP addresses, which could indicate a command-and-control channel.

Remediation Steps

1. Patch Immediately: Due to active exploitation, applying the patches released by SonicWall for both vulnerabilities is the highest priority. This is a critical action.
2. Restrict Management Access: As a best practice, the SonicWall appliance's management console (AMC) should not be exposed to the internet. Access should be restricted to a secure, internal management network.
3. Hunt for Compromise: If a device was vulnerable, it should be considered potentially compromised. Security teams should hunt for any signs of persistence, such as new user accounts, unauthorized SSH keys, or suspicious cron jobs. If compromise is suspected, the device should be wiped and rebuilt from a trusted image after patching.