CVE-2025-32819

high

Description

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0011

https://www.theregister.com/2025/07/16/sonicwall_vpn_hijack/

https://www.securityweek.com/sonicwall-sma-appliances-targeted-with-new-overstep-malware/

https://www.databreachtoday.com/hackers-use-backdoor-to-steal-data-from-sonicwall-appliance-a-28979

https://www.bleepingcomputer.com/news/security/sonicwall-sma-devices-hacked-with-overstep-rootkit-tied-to-ransomware/

https://thehackernews.com/2025/07/unc6148-backdoors-fully-patched.html

https://securityaffairs.com/177626/hacking/sonicwall-fixed-sma-100-flaws-that-could-be-chained-to-execute-arbitrary-code.html

https://cyberscoop.com/sonicwall-exploited-vulnerabilities-surge/

https://www.securityweek.com/possible-zero-day-patched-in-sonicwall-sma-appliances/

https://www.helpnetsecurity.com/2025/05/08/sonicwall-sma100-vulnerability-exploited-cve-2025-32819/

https://www.darkreading.com/endpoint-security/sonicwall-patch-exploit-chain-sma-devices

https://www.bleepingcomputer.com/news/security/sonicwall-urges-admins-to-patch-vpn-flaw-exploited-in-attacks/

https://thehackernews.com/2025/05/sonicwall-patches-3-flaws-in-sma-100.html

https://www.darkreading.com/remote-workforce/fully-patched-sonicwall-gear-zero-day-attack

https://therecord.media/sonicwall-sma-100-series-overstep-malware-unc6148

https://cyberscoop.com/sonicwall-sma100-attacks/

https://arstechnica.com/security/2025/07/google-finds-custom-backdoor-being-installed-on-sonicwall-network-devices/

Details

Source: Mitre, NVD

Published: 2025-05-07

Updated: 2025-05-19

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00033

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest

Detections

Analytics