CVE-2025-40602

Description

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

Scoring

• CVSS: 6.6 (MEDIUM, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-12-17
• Remediation due date: 2025-12-24
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-250
• CWE-862

References

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40602

More from SonicWall

• CVE-2026-83549 — SMA1000 Appliances
• CVE-2026-83548 — SMA1000 Appliances
• CVE-2026-15410 — SMA1000 Appliances
• CVE-2026-15409 — SMA1000 Appliances
• CVE-2023-44221 — SMA100 Appliances