CVE DatabaseCVE-2025-23006

Updated 2026-09-24한국어 권고문 →

CVE-2025-230069.8/CRITICALCISA KEVCWE-502

SonicWall SMA1000 AMC and CMC Pre-Authentication Remote Code Execution (RCE) Vulnerability (CVE-2025-23006) Security Advisory

⚡ Jump to Patch

Affected Vendors

sonicwall

Affected Components

sma1000, appliance management console, central management console

Published Date

2025-01-23

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

26.6%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC)

Impact

A remote unauthenticated attacker can exploit a deserialization of untrusted data vulnerability to execute arbitrary OS commands on the target system

Mitigation

Immediately apply the official security patches provided by SonicWall and restrict external access to the management consoles

Affected Products & Version Scope

SonicWall SMA1000 series Appliance Management Console (AMC) and Central Management Console (CMC)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Refer to the SonicWall official advisory (SNWLID-2025-0002) to upgrade your appliance firmware to the latest patched version. Below is an conceptual CLI upgrade sequence.

bash

# 1. Access SonicWall SMA1000 CLI and verify current version
show system version

# 2. Import and apply the official patched firmware image
import-config sftp://admin@deploy-server/firmware/sma1000-latest-patch.bin
upgrade system

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict access to the AMC (default port 8443) and CMC interfaces from the public internet. Implement strict firewall rules to allow access only from trusted administrative subnets.

bash

# Restrict access to AMC port (e.g., TCP 8443) to trusted management subnet only
iptables -A INPUT -p tcp -s 192.168.10.0/24 --dport 8443 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP

3. Log Audit & IoC Verification Commands

Audit the management console logs for suspicious POST requests or deserialization-related indicators.

bash

# Search AMC access logs for potential deserialization payloads or unusual POST requests
grep -Ei 'unserialize|object|java.io|bin' /var/log/httpd/amc_access.log

# Check for recently modified files in the web directory that could indicate web shell deploymentind /var/www/html/ -mtime -7 -type f

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild (CISA KEV), immediately restrict public access to the SMA1000 management interfaces and apply the vendor patches.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-23006) is a deserialization of untrusted data vulnerability (CWE-502) residing in the Appliance Management Console (AMC) and Central Management Console (CMC) of SonicWall SMA1000 appliances. The root cause lies in the unsafe deserialization of user-supplied input without proper validation, allowing attackers to inject malicious payloads.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted serialized object to the vulnerable management console endpoints. Since no authentication is required (Pre-authentication), any exposed management interface is highly vulnerable. Upon receiving the payload, the application deserializes the data, triggering a gadget chain that leads to arbitrary OS command execution with system privileges.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability poses an immediate threat as active exploitation has been confirmed. Successful exploitation allows complete compromise of the VPN gateway and management infrastructure, potentially leading to lateral movement, credential theft, and full network compromise.

Official Vendor Advisories & References

NVD Original English Description

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002

Source: PSIRT@sonicwall.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23006

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-23006)

FAQ

Q1. How critical is CVE-2025-23006 and is it actively exploited in the wild?

CVE-2025-23006 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 26.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-23006?

Primary impacted vendors include sonicwall across sma1000, appliance management console, central management console. Scope summary: SonicWall SMA1000 series Appliance Management Console (AMC) and Central Management Console (CMC)

Q3. What temporary mitigations or workarounds exist for CVE-2025-23006 before patching?

[Mitigation] Immediately apply the official security patches provided by SonicWall and restrict external access to the management consoles Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION