SonicWall Untrusted Data Pre-authentication Deserialization [CVE-2025-23006]

The SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) SonicWall products have a high severity (CVSS 9.8) vulnerability [CVE-2025-23006] affecting critical network infrastructure.

SonicWall SMA1000 allows companies to securely bridge on-prem and cloud infrastructure and authenticate users to give them access to needed in company resources. These appliances play a critical role for the security of organizations, but also make them attractive targets for attackers.

There’s a flaw with data deserialization before authentication, allowing an attacker to force the device to read arbitrary data (and potentially execute arbitrary commands) without being authenticated.

What To Do

Follow the SonicWall remediation advice and update to the latest version.

Resources

• SonicWall Product Notice, “Urgent Security Notification - SMA 1000”
• SonicWall Security Advisory, “SMA1000 Pre-Authentication Remote Command Execution Vulnerability”