CVE-2025-40602 - AskarLabs CVE Database

CVE-2025-40602

Vendor Sonicwall

Product SMA1000

Weakness CWE-862 · Missing authorization

KEV Status Known Exploited

Published December 18, 2025

Last update December 18, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

CISA mandated remediation

02CISA Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable

Key dates

03Disclosure timeline

December 18, 2025 CVE published

December 18, 2025 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-40602 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html CISA KEV Reference https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019 CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2025-40602

Identifiers

CVE CVE-2025-40602

CWE CWE-862

Affected versions

Vendor Sonicwall

Product SMA1000

Affected 12.4.3-03093 (platform-hotfix) and earlier versions

Vendor Sonicwall

Product SMA1000

Affected 12.5.0-02002 (platform-hotfix) and earlier versions