Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
CISA KEV·Added 2025-12-17 — agencies required to remediate by 2025-12-24

CVE-2025-40602

MEDIUM

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

Published
Dec 18, 2025
Updated
Dec 19, 2025
Affected
0 pkgs
Patched
None yet
Exploits
1 known

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk60th percentile0.00%
0.00%0.87%1.75%2.62%2.1%0.4%Jan 26Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Description

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

Affected Products

5 products · 10 configurations
OS
sma6200 firmwaresonicwall
≥ 12.5.0 && < 12.5.0-02283
range
OS
sma6210 firmwaresonicwall
≥ 12.5.0 && < 12.5.0-02283
range
OS
sma7200 firmwaresonicwall
≥ 12.5.0 && < 12.5.0-02283
range
OS
sma7210 firmwaresonicwall
≥ 12.5.0 && < 12.5.0-02283
range
Application
sma8200vsonicwall
≥ 12.5.0 && < 12.5.0-02283
range
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

Frequently Asked Questions

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
O3 Security · Impact-Aware SCA

Is CVE-2025-40602 in your stack?

O3 detects CVE-2025-40602 across dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.