Actively exploited in the wild
SonicWall SMA1000 Appliances Deserialization Vulnerability
SonicWall - SMA1000 Appliances · Listed in the CISA KEV since 2025-01-24. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2025-23006
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
A pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
Risk Assessment
An unauthenticated attacker can execute arbitrary commands on the SMA1000 appliance, potentially leading to full compromise of the device and managed systems.
Recommendation
Apply vendor patches for SMA1000 and restrict access to management consoles.
Original NVD description (English source)
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.