CVE-2025-23006

CRITICALCVSS 9.8Known Exploited

CISA Known Exploited Vulnerability

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002 ; https://nvd.nist.gov/vuln/detail/CVE-2025-23006

Remediation deadline: February 14, 2025

Ransomware use: Known

Description

SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.

Timeline

Published:January 23rd, 2025 12:15 PM

Last modified:August 4th, 2026 5:16 AM

Added to KEV:January 24th, 2025

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

sonicwall

Products

sma8200vsma6200_firmwaresma6210_firmwaresma7200_firmwaresma7210_firmwaresra_ex6000_firmwaresra_ex7000_firmwaresra_ex9000_firmware