CVE-2025-40598

This flaw can make a legitimate device-management page run code supplied by an attacker when someone opens a specially made link. It is like a fake instruction sheet being slipped into your office binder: the binder is real, but following the inserted instruction can cause harmful actions under the reader’s access.

This matters to you if you run an SMA100 series appliance, especially an SMA 210, SMA 410, or SMA 500v. An attacker does not need a login, but must get someone to open a crafted request; exposure is greatest when the web interface is reachable from the internet.

No active attacks are confirmed, and this issue is not listed in the government’s catalog of vulnerabilities known to be exploited. Treat this as planned-but-prompt maintenance: update the affected devices and reduce public access to their management interface while the update is pending.

Confirm the appliance model, installed firmware, and whether the management web interface is exposed to the internet. For SMA 210, SMA 410, and SMA 500v, target firmware 10.2.2.1-90sv or later; the findings do not provide a fixed version for SMA 100, so obtain the applicable remediation from the vendor before changing it.

Schedule the firmware upgrade under your normal change process and verify that administrator access and device functions work afterward. No breaking-change information was provided. If patching is delayed, restrict the management interface to trusted administrator networks or a private access path, and warn administrators not to follow unsolicited links to the interface.

There is no CISA KEV due date because this CVE is not listed in KEV. Review web-interface and administrator activity for unexpected requests or changes around the time of the upgrade.

CVSS v3.1: 6.1 (Medium), with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The weakness is CWE-79 reflected cross-site scripting in the SMA100 series web interface: an unauthenticated remote attacker can induce JavaScript execution in a victim browser, requiring user interaction. No public exploit code is on record and CISA KEV does not list this CVE. EPSS predicts 50.7% likelihood (99th percentile) and is rising; this is predictive risk, not evidence of active exploitation.