CVE-2025-40602

State: Published
Severity: 6.6 Medium
Published: Dec 18, 2025
Updated: Dec 18, 2025
Reserved: Apr 16, 2025

Description

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-862 Missing Authorization
CWE-250 Execution with Unnecessary Privileges

Affected Products

Product	Versions
SMA1000SonicWall	12.4.3-03093 (platform-hotfix) and earlier versionsAffected 12.5.0-02002 (platform-hotfix) and earlier versionsAffected

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40602government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.