**SonicWall exploited zero-day**: [SMA1000 Pre-Authentication Remote Command Execution Vulnerability](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002 )
CVE-2025-23006 (**9.8 critical**) Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
> IMPORTANT: SonicWall PSIRT has been notified of possible active exploitation of the referenced vulnerability by threat actors
cc: GoatYell group (npub17la…5j4p) :rainbowCrow: (npub1s6e…n008) Kevin Beaumont (npub1lcc…lcye) BrianKrebs (npub1vc3…axsh)
#zeroday #CVE_2025_23006 #sonicwall #vulnerability #CVE #infosec #cybersecurity #eitw #activeexploitation
Not Simon 🐐
npub14g…xznd6
2025-01-23 12:16:30 UTC
Author Public Key
npub14g0mj0fmn0sepfuhp2wupyk7d8xyz7rezpmrx2gfsav9vxlwxypq4xznd6Seen on
wss://relay.momostr.pinkPublished at
2025-01-23 12:16:30 UTCEvent JSON
{
"id": "f2713d1814a08b7c1e37dbeee4cbdfdc0802fb7142da8dd792a7e1fc3cac1e62",
"pubkey": "aa1fb93d3b9be190a7970a9dc092de69cc41787910763329098758561bee3102",
"created_at": 1737634590,
"kind": 1,
"tags": [
[
"t",
"eitw"
],
[
"p",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"p",
"fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd"
],
[
"t",
"cve"
],
[
"t",
"activeexploitation"
],
[
"t",
"cve_2025_23006"
],
[
"t",
"vulnerability"
],
[
"proxy",
"https://infosec.exchange/@screaminggoat/113877620549384238",
"web"
],
[
"t",
"infosec"
],
[
"t",
"cybersecurity"
],
[
"p",
"f7fad71894e5482996700e5013f0a690af1a51457614240d219a571e99ee61f9"
],
[
"t",
"sonicwall"
],
[
"p",
"662250ce4d037de109a64a6a0230f7899f922b76346388b3e7ca06fe9490358d"
],
[
"t",
"zeroday"
],
[
"proxy",
"https://infosec.exchange/users/screaminggoat/statuses/113877620549384238",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/screaminggoat/statuses/113877620549384238",
"pink.momostr"
],
[
"-"
]
],
"content": "**SonicWall exploited zero-day**: [SMA1000 Pre-Authentication Remote Command Execution Vulnerability](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002 )\nCVE-2025-23006 (**9.8 critical**) Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.\n\n\u003e IMPORTANT: SonicWall PSIRT has been notified of possible active exploitation of the referenced vulnerability by threat actors\n\ncc: nostr:npub17ladwxy5u4yzn9nspegp8u9xjzh35529wc2zgrfpnft3ax0wv8uskq5j4p nostr:npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008 nostr:npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye nostr:npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh \n\n#zeroday #CVE_2025_23006 #sonicwall #vulnerability #CVE #infosec #cybersecurity #eitw #activeexploitation",
"sig": "f45095fc905c72c34c9cccd981255927bc4f663600d10a84929cc1a3082446448b70753168a9e73ad98395efa5ae4849603092d0e1daddc81d2fe1bd0ac0efbd"
}