CVE-2025-23006
Published: 23 January 2025
Summary
CVE-2025-23006 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Sonicwall Sma8200V. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-23006 is a pre-authentication deserialization of untrusted data vulnerability, tracked under CWE-502, that affects the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC). The flaw carries a CVSS 3.1 score of 9.8 and can, under specific conditions, permit remote execution of arbitrary operating system commands.
A remote unauthenticated attacker can exploit the issue over the network with low attack complexity and no user interaction, resulting in full compromise of confidentiality, integrity, and availability on the affected appliance.
The vulnerability appears in the CISA Known Exploited Vulnerabilities catalog, and SonicWall has published an advisory at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002 that addresses mitigation steps and available patches.
EPSS for the CVE rose from a low baseline to a peak of 0.6388 (current value 0.5007), indicating that exploitation interest increased after public disclosure and that the issue merits renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3070
Vulnerability details
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
- CWE(s)
- KEV Date Added
- 24 January 2025
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a pre-auth RCE via deserialization in a public-facing management console, directly enabling T1190 (Exploit Public-Facing Application) for initial access and T1059 (Command and Scripting Interpreter) for arbitrary OS command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires timely patching of the SMA1000 AMC and CMC to directly eliminate the pre-authentication deserialization vulnerability and prevent arbitrary OS command execution.
Information input validation mandates checking the validity of untrusted serialized data prior to deserialization, comprehensively addressing CWE-502 exploitation in the management consoles.
Vulnerability monitoring and scanning identifies CVE-2025-23006 in affected SonicWall appliances, enabling prioritization for remediation.