CVE-2025-32820
published 2025-05-07CVE-2025-32820: A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the…
PriorityP357high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.97%
85.6th percentile
A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make any directory on the SMA appliance writable.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sonicwall | sma100 | — | — |
| sonicwall | sma_100_firmware | < 10.2.1.15-81sv | 10.2.1.15-81sv |
| sonicwall | sma_200_firmware | < 10.2.1.15-81sv | 10.2.1.15-81sv |
| sonicwall | sma_210_firmware | < 10.2.1.15-81sv | 10.2.1.15-81sv |
| sonicwall | sma_400_firmware | < 10.2.1.15-81sv | 10.2.1.15-81sv |
| sonicwall | sma_410_firmware | < 10.2.1.15-81sv | 10.2.1.15-81sv |
| sonicwall | sma_500v_firmware | < 10.2.1.15-81sv | 10.2.1.15-81sv |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS SonicWall SMA Authenticated Arbitrary File Write via NxPostConnectionScriptFileResource (CVE-2025-32820)
suricata·2025-10-06·CVSS 8.8
CVE-2025-32820 [HIGH] ET WEB_SPECIFIC_APPS SonicWall SMA Authenticated Arbitrary File Write via NxPostConnectionScriptFileResource (CVE-2025-32820)
ET WEB_SPECIFIC_APPS SonicWall SMA Authenticated Arbitrary File Write via NxPostConnectionScriptFileResource (CVE-2025-32820)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS SonicWall SMA Authenticated Arbitrary File Write via NxPostConnectionScriptFileResource (CVE-2025-32820)"; flow:established,to_server; http.uri; content:"/__api__/v1/client/nxpostconnectionscript/file"; fast_pattern; http.request_body; content:"name|3d 22|upfile|22|"; content:"filename|3d 22|"; pcre:"/^[^\x22]*?(?:(?:\x2e|%2[Ee]){1,2}(?:\x2f|\x5c|%5[Cc]|%2[Ff]){1,}){2,}/R"; http.method; content:"POST"; reference:url,www.rapid7.com/blog/post/2025/05/07/multiple-vulnerabilities-in-sonicwall-sma-100-series-2025/; reference:cve,2025-32820; classtype:web-application-attack; sid:2065054; rev:1; metadata
No public exploits indexed.
Bleepingcomputer
SonicWall urges admins to patch critical RCE flaw in SMA 100 devices
blogs_bleepingcomputer·2025-07-24·CVSS 6.5
CVE-2025-40599 [MEDIUM] SonicWall urges admins to patch critical RCE flaw in SMA 100 devices
## SonicWall urges admins to patch critical RCE flaw in SMA 100 devices
## Sergiu Gatlan
SonicWall urges customers to patch SMA 100 series appliances against a critical authenticated arbitrary file upload vulnerability that can let attackers gain remote code execution.
The security flaw (tracked as CVE-2025-40599) is caused by an unrestricted file upload weakness in the devices' web management interfaces, which can allow remote threat actors with administrative privileges to upload arbitrary files to the system.
"SonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the specified fixed release version to remediate this vulnerability," the company said . "This vulnerability does not affect SonicWall SSL VPN SMA1000 series products or
Bleepingcomputer
SonicWall urges admins to patch VPN flaw exploited in attacks
blogs_bleepingcomputer·2025-05-08·CVSS 8.8
CVE-2025-32819 [HIGH] SonicWall urges admins to patch VPN flaw exploited in attacks
## SonicWall urges admins to patch VPN flaw exploited in attacks
## Sergiu Gatlan
SonicWall has urged its customers to patch three security vulnerabilities affecting its Secure Mobile Access (SMA) appliances, one of them tagged as exploited in attacks.
Discovered and reported by Rapid7 cybersecurity researcher Ryan Emmons, the three security flaws (CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821) can be chained by attackers to gain remote code execution as root and compromise vulnerable instances.
The vulnerabilities impact SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v devices and are patched in firmware version 10.2.1.15-81sv and higher.
"SonicWall strongly advises users of the SMA 100 series products (SMA 200, 210, 400, 410, and 500v) to upgrade to the mentioned fixed release
2025-05-07
Published