SonicWall SMA1000 Appliances Deserialization Vulnerability (CVE-2025-23006)
Published Last modified In CISA KEV since Sources: CVE.org, pwn.watch
What is affected, what to do
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update sma8200v to version 12.4.3-02854. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- SonicWall SMA1000
eq 12.4.3-02804 (platform-hotfix) and earlier versions...12.4.3-02804 (platform-hotfix) and earlier versions.
- SonicWall SMA1000
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
9.8
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: NVD, CVSS v3
9.8
CVSS v3
Severity Critical on the scale from 0 to 10.
Source: CVE.org, pwn.watch
23.4 %
EPSS score
Elevated — model estimates 10-50% exploitation likelihood.
Source: FIRST EPSS, percentile 97.8
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 258.11 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploitedSource: VulnCheck KEV (opens in a new tab), CERT.at How we classify
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 9.8 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 9.8
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 23.4 %
- Elevated — model estimates 10-50% exploitation likelihood.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 97.8
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossaryCWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-502
Response and mitigation
Why act now?
Prioritisation rationale
This flaw is reachable over the network with no authentication or user interaction, and it yields full OS command execution on a perimeter device that brokers remote users' credentials and sessions. CISA flags known use in ransomware campaigns, and SSL-VPN gateways are a favoured initial-access vector for credential harvesting and pivoting inside the network. Exploitation likelihood is very high, placing this among the most actively targeted CVEs. Treat any SMA1000 with an internet-reachable AMC/CMC as critical, requiring an emergency change plus a compromise assessment. Units whose management plane is verifiably internal-only remain high priority and should be patched within days.
Runbook step 1
Immediate response (0-24 h)
- Inventory: Identify every SMA1000 appliance (SMA 6200/6210/7200/7210, SMA 8200v) and legacy SRA EX units (EX6000/EX7000/EX9000). Builds 12.4.3-02854 (SMA) and 12.4.3-02804 (SRA EX), and older, are listed as affected. A patch is available from the vendor; look up the fixed platform-hotfix version in the SonicWall PSIRT advisory.
- Lock down management access now: The Appliance Management Console (AMC) and Central Management Console (CMC) must not be reachable from the internet. Restrict them via perimeter firewall or appliance ACL to a dedicated admin network or jump-host allowlist. This control works regardless of patch level.
- Deploy the vendor hotfix: Push the hotfix as an emergency change, starting with any appliance whose AMC/CMC was internet-exposed. Afterwards, verify and record the build in the AMC as evidence for NIS2 reporting.
- Assume compromise on exposed units: Patching does not remove implants that are already in place. If AMC or CMC was exposed, export logs and back up the configuration before patching. On any anomaly, rebuild the appliance per vendor guidance rather than just patching it.
- Rotate secrets: Renew local appliance admin accounts, LDAP/AD bind service accounts, RADIUS shared secrets, and TLS certificates and private keys. If compromise is suspected, also terminate active VPN sessions and force password resets for privileged VPN users.
- Check reporting duties: If you find exploitation indicators, prepare the NIS2 24-hour early warning to your national CSIRT/authority. Engage your IR team or an external DFIR retainer.
Runbook step 2
Mitigation layers
- Network segmentation: Place the SMA management interface in a dedicated management VLAN that accepts inbound traffic only from named admin source IPs. Allow egress from the appliance only to required destinations (NTP, DNS, LDAP/RADIUS, vendor update servers) and default-deny everything else. This kills reverse shells and tool staging.
- IPS/WAF: Where TLS inspection of the management plane is feasible, enable Java deserialisation signatures (
aced0005hex orrO0ABBase64 in HTTP bodies and parameters) in front of the appliance. Load vendor IPS signatures for CVE-2025-23006 on upstream firewalls and set them to block. - IAM / least privilege: Allow AMC/CMC access only through a hardened, MFA-protected jump host, and keep admin accounts to the minimum. The appliance's LDAP bind account should be read-only, kept out of privileged AD groups, and logon-restricted to the appliance.
- Configuration and hardening: Disable unused management services. Forward all appliance logs (system, audit, web) to the SIEM so evidence survives on-box tampering.
- Lifecycle: Check the support status of SRA EX units. If they no longer receive hotfixes, plan replacement and, until then, take them off the internet or front them with a separate access layer.
Runbook step 3
Detection rules
- AMC/CMC access from unauthorised sources: Look for firewall or Zeek
conn.logentries to the appliance management interface from IPs outside the admin allowlist. KQL sketch:CommonSecurityLog | where DestinationIP in (sma_mgmt_ips) and not(ipv4_is_in_any_range(SourceIP, admin_ranges)). - Appliance-initiated egress: Watch Zeek or NetFlow for connections from the SMA management IP to unknown internet hosts. Unusual ports, long-lived sessions and HTTP downloads with
curl/wgetuser agents are the strongest signals. Sigma shape:src_ip|in: sma_ips AND dst_ip|not_in: allowlist. - Deserialisation payloads: Alert on Suricata or proxy hits for
rO0ABoraced0005in requests to AMC/CMC. Also flag oversized POSTs and bursts of HTTP 500 responses from a single source. - Appliance audit log: Alert via SIEM syslog correlation on new local admin accounts, configuration changes outside change windows, logins from unfamiliar IPs, and unexpected reboots.
- Downstream activity: Watch for the LDAP bind account or VPN users authenticating to atypical hosts. Relevant events include Windows 4624 (logon type 3/10) and 4625 from the SMA IP or VPN pool into server segments, and 4769 Kerberos requests with RC4 from those sources. This pattern often precedes lateral movement and ransomware staging.
- AMC/CMC access from unauthorised sources: Look for firewall or Zeek
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
Source: NVD (NIST), CISA KEV Catalog, cvelistv5, CVE.org (MITRE), pwn.watch
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
| Affected versions | Fixed in | ||
|---|---|---|---|
| SonicWall | SMA1000 |
|
|
| sonicwall | sma8200v |
|
|
Vendors and products
Affected operating systems
| Other | sonicwall | sma6200_firmware | — |
| Other | sonicwall | sma6210_firmware | — |
| Other | sonicwall | sma7200_firmware | — |
| Other | sonicwall | sma7210_firmware | — |
| Other | sonicwall | sra_ex6000_firmware | — |
| Other | sonicwall | sra_ex7000_firmware | — |
| Other | sonicwall | sra_ex9000_firmware | — |
Weakness classes (CWE)
CWE-502Deserialization of Untrusted Data
Base
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Entry at MITRE CWE-502
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited |
References & sources
- psirt.global.sonicwall.comSonicWall advisory: SonicWall SMA1000 AppliancesVendor advisory, pwn-watch
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23006government-resource
- cert.atCERT.at: Kritische Sicherheitslücke in SonicWall SMA1000 - aktiv ausgenutzt - Update verfügbarcert-at
- pwn.watchpwn.watch: SonicWall SMA1000 Appliances: SMA1000 Appliances Deserialization Vulnerabilitypwn-watch
- NVD (NIST)NVD: CVE-2025-23006pwn-watch
- cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
Changes to this CVE
Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).
One NVD translation into another language is hidden.
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2025-23006"><img src="https://intel.neosec.eu/badge/cve/CVE-2025-23006.svg?lang=en" alt="CVE-2025-23006 – NEOSEC Intel" height="20"></a>