Security readout for executives and security teams
Plain-English summary
A remote attacker may compromise vulnerable SonicWall SMA1000 management consoles without credentials or user interaction. Successful exploitation could run operating-system commands, exposing sensitive information, changing appliance behavior, or disrupting service. CISA lists the vulnerability as known exploited, making affected deployments an urgent business risk.
Executive priority
Treat as an emergency remediation item. The combination of unauthenticated remote command execution, CVSS 9.8 severity, and confirmed KEV status creates a credible compromise risk. Identify exposed SMA1000 systems immediately, restrict management reachability, apply vendor guidance, and investigate potentially exposed appliances.
Technical view
CVE-2025-23006 is a pre-authentication deserialization vulnerability (CWE-502) in the SMA1000 Appliance Management Console and Central Management Console. Under unspecified conditions, network-reachable vulnerable consoles may permit unauthenticated arbitrary OS command execution. It carries CVSS 3.1 score 9.8 with high confidentiality, integrity, and availability impacts.
Likely exposure
Exposure applies to SonicWall SMA1000 versions 12.4.3-02804 platform-hotfix and earlier. Risk is greatest where AMC or CMC is reachable from untrusted networks. The supplied evidence does not identify deployment prevalence, required specific conditions, or affected CPEs.
Exploitation context
CISA's Known Exploited Vulnerabilities listing supports active exploitation in the wild. The supplied sources do not describe exploitation volume, targeted organisations, indicators of compromise, attacker identity, or campaign details. Absence of those details should not reduce urgency.
Researcher notes
The source bundle establishes CWE-502, pre-authentication reachability, possible OS command execution, affected versions, and KEV status. It does not disclose the serialized object path, vulnerable component internals, triggering conditions, exploitation telemetry, indicators, or an explicit fixed-version number. Researchers should avoid assuming details beyond the vendor advisory.
Mitigation direction
- Inventory SMA1000 appliances and identify versions 12.4.3-02804 platform-hotfix or earlier.
- Follow the SonicWall advisory for the supported corrected release or vendor-prescribed remediation.
- Restrict AMC and CMC access to trusted administrative networks while remediation is pending.
- Prioritise internet-reachable or otherwise untrusted-network-reachable management consoles.
- Engage SonicWall support if the applicable upgrade path or affected status remains unclear.
Validation and detection
- Verify each SMA1000 version directly against the vendor advisory's affected-version guidance.
- Confirm whether AMC or CMC is reachable from internet or other untrusted networks.
- Review appliance and surrounding security logs for unexplained management activity or command execution.
- After remediation, confirm the installed release is outside the vendor-defined affected range.
- Validate that management access restrictions remain enforced after upgrades or configuration changes.
Public sources used
The source record changed after analysis: Material source record changed after analysis.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-23006 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-23006 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-01-24T00:00:00.000Z: CVE-2025-23006 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002CVE reference, sonicwall · vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23006CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.