CVE-2025-23006
Published 2025-01-23 · Updated 2026-09-24 · Source PSIRT@sonicwall.com
Summary
CVE-2025-23006 is a critical-severity (CVSS 9.8) vulnerability in SonicWall SMA1000 Appliances. CISA added it to the Known Exploited Vulnerabilities catalog on January 24, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 14, 2025. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. SonicWall has 20 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.
All 20 known-exploited SonicWall vulnerabilities →Description
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: SonicWall — SMA1000 Appliances
Name: SonicWall SMA1000 Appliances Deserialization Vulnerability
Date added: 2025-01-24 · Due: 2025-02-14
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.