CVE-2025-23006

CRITICAL KEV RANSOMWARE

SonicWall SMA/SRA < 12.4.3 - Unauthenticated RCE via Deserialization

Title source: llm

Exploitation Summary

CVE-2025-23006 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 24, 2025, with confirmed use in ransomware campaigns.

Description

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.

References (2)

Core 2

Core References

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23006

Vendor Advisory vendor-advisory

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002

Scores

CVSS v3 9.8

EPSS 0.5007

EPSS Percentile 97.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable yes

Technical Impact total

Details

CISA KEV 2025-01-24

VulnCheck KEV 2025-01-22

ENISA EUVD EUVD-2025-3070

Ransomware Use Confirmed

CWE

CWE-502

Status published

Products (8)

sonicwall/sma6200_firmware < 12.4.3-02854

sonicwall/sma6210_firmware < 12.4.3-02854

sonicwall/sma7200_firmware < 12.4.3-02854

sonicwall/sma7210_firmware < 12.4.3-02854

sonicwall/sma8200v < 12.4.3-02854

sonicwall/sra_ex6000_firmware < 12.4.3-02804

sonicwall/sra_ex7000_firmware < 12.4.3-02804

sonicwall/sra_ex9000_firmware < 12.4.3-02804

Published Jan 23, 2025

KEV Added Jan 24, 2025

Tracked Since Feb 18, 2026