CVE-2025-23006
Published: 23 January 2025
Summary
CVE-2025-23006 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Sonicwall Sma8200V. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires timely patching of the SMA1000 AMC and CMC to directly eliminate the pre-authentication deserialization vulnerability and prevent arbitrary OS command execution.
Information input validation mandates checking the validity of untrusted serialized data prior to deserialization, comprehensively addressing CWE-502 exploitation in the management consoles.
Vulnerability monitoring and scanning identifies CVE-2025-23006 in affected SonicWall appliances, enabling prioritization for remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a pre-auth RCE via deserialization in a public-facing management console, directly enabling T1190 (Exploit Public-Facing Application) for initial access and T1059 (Command and Scripting Interpreter) for arbitrary OS command execution.
NVD Description
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
Deeper analysisAI
CVE-2025-23006 is a pre-authentication deserialization of untrusted data vulnerability (CWE-502) identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC). Published on 2025-01-23, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impacts across confidentiality, integrity, and availability.
The vulnerability can be exploited by a remote unauthenticated attacker who, under specific conditions, could execute arbitrary operating system commands on affected systems. This requires network access with low complexity and no privileges or user interaction, enabling full compromise without authentication.
Mitigation guidance is available in the SonicWall PSIRT advisory (SNWLID-2025-0002) at https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002. The vulnerability is also listed in the CISA Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-23006, signaling real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 24 January 2025