CRITICAL🇵🇱 Wersja polska

CVE-2025-40599

CVSS 9.1v3.1pub. 2025-07-23upd. 2025-11-06

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Sonicwall Sma 210

    HW
    Sonicwall
    wszystkie wersje

  • Sonicwall Sma 210 Firmware

    OS
    Sonicwall
    < 10.2.2.1-90sv

  • Sonicwall Sma 410

    HW
    Sonicwall
    wszystkie wersje

  • Sonicwall Sma 410 Firmware

    OS
    Sonicwall
    < 10.2.2.1-90sv

  • Sonicwall Sma 500v

    HW
    Sonicwall
    wszystkie wersje

  • Sonicwall Sma 500v Firmware

    OS
    Sonicwall
    < 10.2.2.1-90sv
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2024-38475CRITICAL9.1⚠ KEVPL ✓ten sam produkt

Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie

CVE-2021-20038CRITICAL9.8⚠ KEVten sam produkt

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variabl...

CVE-2021-20028CRITICAL9.8⚠ KEVten sam produkt

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure R...

CVE-2021-20016CRITICAL9.8⚠ KEVten sam produkt

A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker ...

CVE-2022-22273CRITICAL9.8ten sam produkt

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-lif...