- Microsoft found a zero-day in a Sonicwall remote Agency
- It was allegedly already exploited in nature
- Hackers used it to perform code external
Hackers abuse a zero day in a Sonicwall product to break into corporate networks and implement malware, experts have warned.
In a security advice, Sonicwall urged its users to use patch or insert a solution as soon as possible.
Vulnerability is traced as CVE-2025-23006. The national vulnerability database (NVD) gave it a severity of 9.6/10 – critical. It was discovered by Microsoft in the SMA 1000 Appliance Management Console (AMC) and Central Management Console (CMC), tools designed to control and control Sonicwall Network Security devices, especially in environments where safe remote access and centralized management are priorities.
Thousands of vulnerable appliances
The error was described as a “deserialization of the forautization of non-trusted data”, and says that under specific conditions they can enable a distant unauthorized striker to perform arbitrary OS commands.
“Sonicwall Psirt has been notified of possible active exploitation of the referenced vulnerability of threat players,” the advisory reads. “We strongly advise users of the SMA1000 product to upgrade to the Hotfix release version to tackle the vulnerability.”
Both Sonicwall and Microsoft do not say who attackers are who the victims were or how many there were.
With reference to results from the Shodan search engine, Bleeping computer said there are “several thousand” SMA 1000 devices postponed on the Internet, which suggested a potentially wide attack landscape for the threat actors. In recent times, threat actors have increasingly focused on edge units as they are not so frequently monitored and allow them to break into the target infrastructure and move laterally while remaining somewhat hidden.
Sonicwall added that Firewall and SMA 100 series products are not affected by the vulnerability.
In the advisory, the company also added that to minimize the potential impact of the error, users must ensure that they limit access to trusted sources of the device management console (AMC) and Central Management Console (CMC).
Via Techcrunch
