⚠ Actively exploited
Added to CISA KEV on 2025-12-17. Federal agencies required to patch by 2025-12-24. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-40602 — Execution with Unnecessary Privileges in Sma6200 Firmware
Severity
6.6MEDIUMNVD
EPSS
0.3%
top 45.90%
CISA KEV
KEV
Added 2025-12-17
Due 2025-12-24
Exploit
No known exploits
Affected products
Timeline
KEV addedDec 17
PublishedDec 18
KEV dueDec 24
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable
Description
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.7 | Impact: 5.9
Affected Packages6 packages
▶CVEListV5sonicwall/sma100012.4.3-03093 (platform-hotfix) and earlier versions, 12.5.0-02002 (platform-hotfix) and earlier versions+1
🔴Vulnerability Details
3CVEList▶
CVE-2025-40602: A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC)↗2025-12-18
GHSA▶
GHSA-p9f8-2p87-2pq5: A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC)↗2025-12-18