CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization

What is CVE-2025-23006?

CVE-2025-23006 is a critical unsafe deserialization vulnerability in SonicWall SMA1000, published on 23 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.

Weakness: CWE-502

Which versions are affected by CVE-2025-23006?

It affects 8 products.

Products include Sonicwall Sma6200 Firmware, Sonicwall Sma6210 Firmware, Sonicwall Sma7200 Firmware, Sonicwall Sma7210 Firmware, Sonicwall Sma8200v, Sonicwall Sra Ex6000 Firmware and 2 more.

How do I fix CVE-2025-23006?

No fix has been published for CVE-2025-23006 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Feb 2025.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2025-23006 being exploited?

Yes. Attackers have exploited CVE-2025-23006 in the wild since at least 24 Jan 2025, including in ransomware campaigns.

Other vulnerabilities in SonicWall SMA1000

• CVE-2025-40602 SonicWall SMA1000 Missing Authorization Exploited Medium 6.6
• CVE-2026-4112 SQL injection in SMA1000 High 7.2
• CVE-2026-4113 Information disclosure in SMA1000 High 7.2
• CVE-2026-4116 Auth bypass in SMA1000 High 7.2
• CVE-2026-4114 Auth bypass in SMA1000 Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-57r3-2prp-v2xh.