CVE-2025-40602

Think of the SMA1000 as a secure “control room” for your network connections, and the AMC as the room’s admin console. This bug lets a highly privileged insider (someone who already has a strong admin login) use the console to escape permission limits and seize full control of the appliance—like turning all locks on the building into their own keys. Because the attacker can change settings and access what the device protects, it’s a direct risk to your business network and data.

This matters if you operate a SonicWall SMA1000 appliance (including SMA6200, SMA6210, SMA7200, SMA7210, and SMA8200v) and you have the Appliance Management Console (AMC) exposed for administration. It is a risk only when an attacker can reach the AMC and has an authenticated high-privilege admin session/ability to act as such (the vulnerability requires high privileges). The reachability path is the web-based management interface over the network, and additional external exposure is not the only requirement—high admin access is.

This is RED because it’s confirmed for action by CISA KEV and an advanced actor (UNC5221) has been associated with exploitation activity. The flaw lets an authenticated high-privilege admin bypass authorization and fully control the appliance, so it’s not just a theoretical issue. Act immediately to upgrade to the fixed firmware and apply SonicWall’s required mitigations if you cannot upgrade by the CISA due date.