← Back to browse · API

CVE-2025-23006

Severity
CRITICAL
CVSS
9.8
EPSS
0.23432
Risk score
72.4
CISA KEV
Yes
PoC
No
Published
2025-01-23
Modified
2026-08-04
First seen
2026-08-05
Aliases
EUVD-2025-3070, GHSA-57R3-2PRP-V2XH
Products
SonicWall:SMA1000 12.4.3-02804 (platform-hotfix) and earlier versions., SonicWall:SMA1000 Appliances, sonicwall:sma6200, sonicwall:sma6200_firmware, sonicwall:sma6210, sonicwall:sma6210_firmware, sonicwall:sma7200, sonicwall:sma7200_firmware, sonicwall:sma7210, sonicwall:sma7210_firmware, sonicwall:sma8200v, sonicwall:sra_ex6000, sonicwall:sra_ex6000_firmware, sonicwall:sra_ex7000, sonicwall:sra_ex7000_firmware, sonicwall:sra_ex9000, sonicwall:sra_ex9000_firmware
Sources
nvd CVE-2025-23006
cisa.gov CVE-2025-23006
euvd EUVD-2025-3070

Description

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.

References