CVE-2025-40602
SonicWall · Published December 18, 2025
6.6
CVSS v3.1
MEDIUMCISA KEV — Federal agencies must patch by deadline
Actively exploited in the wild
Patch availableGet patch
Description
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
Affected Products
- Sma6200 Firmware < 12.4.3-03245
- Sma6200 Firmware < 12.5.0-02283
- Sma6210 Firmware < 12.4.3-03245
- Sma6210 Firmware < 12.5.0-02283
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H