Skip to content

CVE-2025-23006 — SonicWall SMA1000 Deserialization

Key facts

CVE-2025-23006 is a Critical vulnerability: SonicWall SMA1000 Deserialization. This entry ships a detection-only PoC. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-01-24), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

Actively exploited — on the CISA KEV catalog

CVE-2025-23006 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-01-24), confirming exploitation in the wild. It is linked to known ransomware campaigns. Federal remediation deadline: 2025-02-14. Prioritise patching and deploy the detection and prevention rules below.
CVE CVE-2025-23006
Severity Critical
CISA KEV Actively exploited (added 2025-01-24) · ransomware
Detection / prevention —
PoC poc.py
Source 2025/CVE-2025-23006/

Details

Overview

Pre-auth deserialization leading to RCE

Vulnerability Details

  • CVE ID: CVE-2025-23006
  • CVSS Score: 9.8 (Critical)
  • Type: Deserialization
  • Product: SonicWall SMA1000

Affected Products

  • SonicWall SMA1000 (specific versions - check vendor advisory)

Proof of Concept

Usage

python3 poc.py -t https://target.com -c
python3 poc.py -t https://target.com -c --version-only

Mitigation

  1. Apply vendor patches immediately
  2. Implement network segmentation
  3. Monitor for exploitation attempts
  4. Review access controls

References

Disclaimer

This PoC is for authorized security testing only.

Frequently asked questions

What is CVE-2025-23006?

CVE-2025-23006 is a Critical vulnerability: SonicWall SMA1000 Deserialization. This entry ships a detection-only PoC. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-01-24), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

How do I detect CVE-2025-23006?

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2025-23006?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Is CVE-2025-23006 actively exploited?

Yes. CVE-2025-23006 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2025-01-24, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2025-02-14. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.