A pre-authentication deserialization vulnerability has been discovered in SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) and is already being used in zero-day attacks. Review the details within this Cybersecurity Threat Advisory to protect your organization.
What is the threat?
CVE-2025-23006 has a CVSS score of 9.8, enable attackers to remotely execute arbitrary OS commands. In certain conditions, it can potentially allow attackers to gain access to affected appliances.
Why is it noteworthy?
SMA1000 are secure remote access appliances used by organizations to provide VPN access for corporate networks. Given the importance of its role to protect organizations’ network, these devices are prime targets for threat actors, especially when there are unpatched vulnerabilities available to exploit.
What is the exposure or risk?
There are over 2,300 SMS1000 devices currently exposed online. CVE-2025-23006 affects only SMA1000 devices of version 12.4.3-02804 and earlier. Additionally, it does not affect firewalls or SMA100 devices, and as such no action is required for them.
What are the recommendations?
Barracuda recommends the following steps to secure your organization’s network infrastructure against this threat:
- Update SMA1000 appliances to the current version of 12.4.3-02854 and later.
- Restrict access to trusted sources for both the Appliance Management Console and Central Management Console.
- Deploy intrusion detection/prevention systems (IDPs) and web application firewalls (WAFs).
References
For more in-depth analysis of the above recommendations, please visit the following links:
- https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-sma1000-rce-flaw-exploited-in-zero-day-attacks/
- https://www.crn.com/news/security/2025/sonicwall-says-exploitation-of-sma1000-flaw-discovered-by-microsoft?itc=refresh
- https://www.securityweek.com/sonicwall-learns-from-microsoft-about-potentially-exploited-zero-day/
- https://thehackernews.com/2025/01/sonicwall-urges-immediate-patch-for.html
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
This post originally appeared on Smarter MSP.