All CVE records
CVE-2025-40602 — SonicWall SMA1000 Missing Authorization Vulnerability
CISA KEV listed
Added December 17, 2025 Remediate by December 24, 2025
Description
SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
Notes
Check for signs of potential compromise on all internet accessible SonicWall SMA1000 instances after applying mitigations. For more information please see: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019 ; https://nvd.nist.gov/vuln/detail/CVE-2025-40602
Need help remediating this vulnerability?
Our team helps organizations patch, mitigate, and respond to CISA KEV advisories fast.