Cybersecurity Threat Advisory: SonicWall SMA 100 appliance vulnerability

Once an attacker elevates permissions and gains control over remote-access operations, they can manipulate VPN configurations and user sessions, potentially enabling deeper access to internal resources through existing connectivity. Because this vulnerability is actively exploited in the wild, compromised devices may be used to disrupt authentication flows, steal credentials linked to the appliance, and pivot into connected environments after privilege escalation.

• Apply available updates to SMA 100 appliances.
• Limit external access to appliance management interfaces and enforce strong authentication on remote‑access portals.
• Review VPN configurations to reduce avenues for privilege‑escalation abuse tied to CVE‑2025‑40602.
• Preserve appliance and network logs, audit for anomalous administrative actions or configuration changes, and review remote‑access session histories to identify potential exploitation patterns.
• Leverage solutions, such as Barracuda Managed XDR, to alert on indicators of privilege escalation on SMA devices, unexpected policy changes, or creation of new admin accounts; increase scrutiny of authentication events linked to the gateway given confirmed exploitation.
• Enumerate all SMA 100 deployments, validate their software versions against the fixed releases, and document internet‑facing management exposure and access policies to prioritize monitoring and follow‑up actions.