# CVE-2025-40602: SonicWall SMA1000 privilege escalation in AMC

Source: https://junglewise.ai/threats/cve-2025-40602-sonicwall-sma1000-privilege-escalation-in-amc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-17. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-40602 · Severity: critical · CVSS 6.6 · Exploited in the wild · Published 2025-12-17

A security flaw in SonicWall SMA 1000 series remote access appliances could allow an attacker to gain higher-level administrative control over the device. This appliance is typically used to provide secure remote access to corporate networks; an exploit could allow an attacker to modify system settings or disrupt secure connections. This vulnerability has been reported as being actively exploited in the wild.

Technologies: [SonicWall SMA 1000 Series Firmware](https://junglewise.ai/threats/technologies/sma-1000-series-firmware). Vendors: [SonicWall](https://junglewise.ai/threats/vendors/sonicwall).

## Quick answers

**Is CVE-2025-40602 exploited in the wild?** Yes. CVE-2025-40602 is known to be exploited in the wild, first recorded on 17 December 2025. Treat it as urgent.

**How severe is CVE-2025-40602?** Critical severity, with a CVSS score of 6.6, published 17 December 2025.

**Which products and versions are affected?** SonicWall SMA 1000 Series Firmware Versions up to 12.4.3-03245 and 12.5.0 up to 12.5.0-02283; SonicWall Sma 8200v Versions up to 12.4.3-03245 and 12.5.0 up to 12.5.0-02283.

**Is there a fix for CVE-2025-40602?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-40602 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-40602?** Check whether you run SonicWall SMA 1000 Series Firmware, SonicWall Sma 8200v or SonicWall SMA1000 Appliance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) and execution with unnecessary privileges (CWE-250) exists in the SonicWall SMA1000 Appliance Management Console (AMC). The flaw allows an authenticated user with high privileges to escalate their permissions further within the management interface. While the NVD description notes it as 'local privilege escalation,' the CISA-ADP CVSS vector indicates a network attack vector with high complexity and high privileges required. This vulnerability is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. Patches are available in firmware versions 12.4.3-03245 and 12.5.0-02283.

## Affected products

- SonicWall SMA 1000 Series Firmware Versions up to 12.4.3-03245 and 12.5.0 up to 12.5.0-02283
- SonicWall SMA 8200v Versions up to 12.4.3-03245 and 12.5.0 up to 12.5.0-02283

## Timeline

- 2025-12-17: disclosed
- 2025-12-17: kev added: Added to CISA KEV catalog due to active exploitation.
- 2025-12-18: advisory

## Related threats

- [SonicWall SMA1000 SSRF in Work Place interface](https://junglewise.ai/threats/cve-2026-15409-sonicwall-sma1000-ssrf-in-work-place-interface)
- [SonicWall SMA 1000 Series credential enumeration via response discrepancy](https://junglewise.ai/threats/cve-2026-4113-sonicwall-sma-1000-series-credential-enumeration-via-response)