CVE-2025-23006: SonicWall SMA1000 Appliances Deserialization Vulnerability

Vulnerability summary

CVE-2025-23006 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in SonicWall SMA1000 Appliances. It is known to be exploited: CISA lists it, first on 24-01-2025. It has been used in ransomware campaigns. EPSS estimates a 23.43% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities.

Timeline

1. 23-01-2025
   PublishedVulnerability first disclosed.
2. 24-01-2025
   Added to CISA KEVSonicWall SMA1000 Appliances Deserialization Vulnerability
3. 14-02-2025
   CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 04-08-2026
   Last modifiedVulnerability information updated.

Description

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.