CVE-2025-40602 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.6 MEDIUM	NETWORK	HIGH	HIGH	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
sonicwall	CNA	---				---
CISA-ADP	ADP	6.6 MEDIUM	NETWORK	HIGH	HIGH	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 80%

Vendor	Product	Version
sonicwall	sma6200_firmware	𝑥 < 12.4.3-03245
sonicwall	sma6200_firmware	12.5.0 ≤ 𝑥 < 12.5.0-02283
sonicwall	sma6210_firmware	𝑥 < 12.4.3-03245
sonicwall	sma6210_firmware	12.5.0 ≤ 𝑥 < 12.5.0-02283
sonicwall	sma7200_firmware	𝑥 < 12.4.3-03245
sonicwall	sma7200_firmware	12.5.0 ≤ 𝑥 < 12.5.0-02283
sonicwall	sma7210_firmware	𝑥 < 12.4.3-03245
sonicwall	sma7210_firmware	12.5.0 ≤ 𝑥 < 12.5.0-02283
sonicwall	sma8200v	𝑥 < 12.4.3-03245
sonicwall	sma8200v	12.5.0 ≤ 𝑥 < 12.5.0-02283

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-250 - Execution with Unnecessary Privileges
The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Vulnerability Media Exposure

[ENGLISH] SonicWall Fixes Actively Exploited CVE-2025-40602 in SMA 100 Appliances
SonicWall has rolled out fixes to address a security flaw in Secure Mobile Access (SMA) 100 series appliances that it said has been actively exploited in the wild. The vulnerability, tracked as CVE-2025-40602 (CVSS score: 6.6), concerns a case of local privilege escalation that arises as a result of insufficient authorization in the appliance management console (AMC). It affects the following
Published: 2025-12-17T23:47:00+05:30
[GERMAN] Angriffe auf Zero-Day-Lücken: Cisco, Sonicwall und Asus Live Update
Die CISA warnt vor beobachteten Angriffen auf Cisco-, Sonicwall- und Asus-Sicherheitslücken. Updates sind teils verfügbar.
Published: 2025-12-18T06:47:00+00:00
[GERMAN] SonicWall SMA1000 (AMC): Schwachstelle ermöglicht Privilegieneskalation
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in SonicWall SMA ausnutzen, um seine Privilegien zu erhöhen.
Published: 2025-12-17T23:00:00+00:00
[ENGLISH] Another bad week for SonicWall as SMA 1000 zero-day under active exploit
Flaw in remote-access appliance lets attackers chain bugs for root-level takeover SonicWall has warned customers of a zero-day flaw in its SMA 1000 remote-access appliance that's being actively exploited, potentially allowing attackers to escalate privileges and take over boxes.…
Published: 2025-12-18T14:34:15+00:00
[ENGLISH] ⚡ Weekly Recap: Firewall Exploits, AI Data Theft, Android Hacks, APT Attacks, Insider Leaks & More
Cyber threats last week showed how attackers no longer need big hacks to cause big damage. They’re going after the everyday tools we trust most — firewalls, browser add-ons, and even smart TVs — turning small cracks into serious breaches. The real danger now isn’t just one major attack, but hundreds of quiet ones using the software and devices already inside our networks. Each trusted system can
Published: 2025-12-22T17:30:00+05:30

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40602