CVE-2025-40602: SonicWall SMA1000 management console missing authorization privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is in CISA KEV with known exploitation and a short remediation deadline, though it requires high privileges and has a medium CVSS score.

What it is

The SonicWall SMA1000 appliance management console (AMC) contains a local privilege escalation flaw caused by insufficient authorization, mapped to CWE-250 and CWE-862. An actor who already holds high privileges on the console can bypass authorization checks and execute with unnecessary privileges, which matters because it lets a limited admin escalate to full control of the appliance.

Impact

An attacker with existing high-privileged access to the AMC gains elevated execution on the appliance, potentially taking over the management console and the SMA1000 device itself.

Attack surface

The CVSS vector is network-reachable (AV:N) but requires high privileges (PR:H) and no user interaction (UI:N), so it is reached by an authenticated high-privileged user of the management console rather than an unauthenticated remote attacker.

Exploitation

CVE-2025-40602 was added to CISA KEV on 2025-12-17 with a remediation due date of 2025-12-24, indicating known exploitation; EPSS 30-day probability is 0.02083 (80.6th percentile), and no ransomware campaign use is documented.

What to do

• Apply the SonicWall vendor fix per PSIRT advisory SNWLID-2025-0019 as the first action.
• If patching is not immediately possible, follow CISA BOD 22-01 guidance and the vendor's mitigations, or discontinue use of the affected SMA1000 appliances.
• Restrict and audit AMC administrative access, limiting high-privileged accounts to the minimum necessary personnel.
• Monitor for and investigate unexpected privilege changes or administrative actions on SMA1000 management consoles.

Detection

• Review AMC audit logs for authorization failures or privilege escalation events on SMA1000 appliances.
• Alert on new or modified high-privileged AMC accounts and on administrative actions outside normal change windows.
• Correlate network access to the AMC management interface with authentication events to spot anomalous high-privileged sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.