DaystoPatch

SonicWallExploited incident

SonicWall SMA1000 AMC/CMC pre-auth deserialization RCE (zero-day)

CVE-2025-23006Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 24 Jan 2025

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    SonicWall PSIRT SNWLID-2025-0002 (PSIRT API record)CuratedQuote verified

    SonicWall PSIRT has been notified of possible active exploitation of the referenced vulnerability by threat actors.

    Published 2025-01-22T12:45:16Z per the same record; reported by Microsoft Threat Intelligence. No earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1a979e27d1cf6539…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    SonicWall advisory SNWLID-2025-0002ClaimedQuote verified22 Jan 2025, 12:45 UTC

    SMA1000 Pre-Authentication Remote Command Execution Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2e9e5b3c39cc0cc5…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet23 Jan 2025, 09:32 UTC

    https://www.helpnetsecurity.com/2025/01/23/sonicwall-sma-1000-exploited-zero-day-cve-2025-23006/

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-23006ClaimedQuote verified23 Jan 2025, 11:37 UTC

    Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ffd31e9fba854242…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-23006)ClaimedQuote verified24 Jan 2025

    SonicWall SMA1000 Appliances Deserialization Vulnerability

    Added to CISA's KEV catalog on 2025-01-24.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet4 Feb 2025, 22:12 UTC

    Mr Gorbachev, tear down this Sonicwall # CVE_2025_23006

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    SonicWall advisory SNWLID-2025-0002ClaimedQuote verified

    SMA1000 Pre-Authentication Remote Command Execution Vulnerability

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2e9e5b3c39cc0cc5…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    SonicWall PSIRT SNWLID-2025-0002 (PSIRT API record)CuratedQuote verified22 Jan 2025, 12:45 UTC

    "published_when":"2025-01-22T12:45:16Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1a979e27d1cf6539…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    at disclosure

    SonicWall PSIRT SNWLID-2025-0002 (PSIRT API record)CuratedQuote verified

    please ensure that you restrict access to trusted sources for the Appliance Management Console (AMC) and Central Management Console (CMC).

    Workaround field; later revisions (23 Jan, 10 Feb 2025) only added a product notice link and IoCs.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1a979e27d1cf6539…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    SonicWall PSIRT SNWLID-2025-0002 (PSIRT API record)CuratedQuote verified

    Version 12.4.3-02854 (platform-hotfix) and higher versions.

    SNWLID-2025-0019 confirms the hotfix was 'released on Jan 22, 2025'. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1a979e27d1cf6539…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    SonicWall PSIRT SNWLID-2025-0002 (PSIRT API record)CuratedQuote verified

    Version 12.4.3-02854 (platform-hotfix) and higher versions.

    Single affected line (12.4.3).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1a979e27d1cf6539…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

SonicWall SMA1000 zero-day lets attackers run commands; hotfix out Jan 22, 2025

Attackers were exploiting an SMA1000 management console flaw that allows unauthenticated command execution when SonicWall released a hotfix on 22 January 2025.

In plain words

SonicWall's SMA1000 remote access appliance had a critical flaw in its management console that attackers were exploiting to run commands without logging in. SonicWall released a fix on 22 January 2025. If we use an SMA1000, it must be on the fixed (or newer) software and its management console must not be reachable from the internet.

What happened and who is affected

What happened

On 22 January 2025 SonicWall disclosed CVE-2025-23006, a pre-authentication deserialization flaw in the SMA1000 Appliance Management Console and Central Management Console (CVSS 9.8), and said it had been notified of possible active exploitation. A platform hotfix, 12.4.3-02854, was released the same day, along with advice to restrict console access to trusted sources. In December 2025 SonicWall reported attackers chaining this bug with CVE-2025-40602 on unpatched devices.

Who is affected

SonicWall SMA1000 appliances on 12.4.3-02804 (platform-hotfix) and earlier. SonicWall firewalls and SMA 100 are not affected.

CVE-2025-23006. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/sonicwall-cve-2025-23006/

Affected products

  • SMA1000 (Appliance Management Console, Central Management Console)
How we built this timeline

Zero-day acknowledged at disclosure ('notified of possible active exploitation'); fixed the same day. KEV 24 Jan 2025, ransomware use Known.

Revision history: v1.0 22-Jan-2025; v1.1 23-Jan-2025 product notice link; v1.2 10-Feb-2025 IoCs. Affected: 12.4.3-02804 (platform-hotfix) and earlier per the record.

Credited to Microsoft Threat Intelligence Center (MSTIC). Related: CVE-2025-40602 (sonicwall-cve-2025-40602) was chained with this bug in later attacks.

R7 (23 Oct 2026): CVE-2025-40602 was exploited in a chain with CVE-2025-23006, but the two were disclosed eleven months apart (22 Jan 2025 and 17 Dec 2025), so they stay separate incidents (cross-reference: sonicwall-cve-2025-23006 / sonicwall-cve-2025-40602). T1 check (23 Oct 2026): SNWLID-2025-0019 states the fixed build 12.4.3-02854 was 'released on Jan 22, 2025', the advisory day, so First fix is not an upper bound in practice; exploited before a fix stays true.

Related

SonicWall report card