Vulnerability details

CVE-2025-40599

SonicWall SMA 100 Series

CVSS 3.1

9.1Critical

Official description

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
SonicWall	SMA 100 Series	10.2.1.15-81sv and earlier versions	CVEProject cvelistV5 (CNA)

References and advisories

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0014 vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-07-23
Last updated: 2025-07-25
State: Published
Assigner (CNA): sonicwall

Exploit prediction (EPSS)

9.69%

Probability of exploitation in 30 days

95.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-434
Unrestricted Upload of File with Dangerous Type