CVE-2025-40599 File upload in SMA 100 Series
An authenticated attacker with admin privileges can upload arbitrary files to the SonicWall SMA 100 web interface, potentially achieving remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40599?
CVE-2025-40599 is a critical vulnerability in SonicWall SMA 100 Series, published on 23 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.
Weakness: CWE-434
Which versions are affected by CVE-2025-40599?
It affects 3 products.
Products include Sonicwall Sma 210 Firmware, Sonicwall Sma 410 Firmware, Sonicwall Sma 500v Firmware.
How do I fix CVE-2025-40599?
No fix has been published for CVE-2025-40599 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-40599 being exploited?
There is no known exploitation of CVE-2025-40599 in the wild and no public exploit code.
Other vulnerabilities in SonicWall SMA 100 Series
Sources
Also known as GHSA-9pr6-9rp3-fq9v.