CVE-2025-40602

MediumCVSS 6.6/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-250CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Dec 17, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-406034.5A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrCVE-2025-406049.8Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifyCVE-2025-406055.3A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injCVE-2025-40617.8A vulnerability, which was classified as critical, was found in code-projects Clothing Store Management System up to 1.0. Affected is the fuCVE-2025-406156.1Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victimCVE-2025-406166.1Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victimCVE-2025-406179.8SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sendinCVE-2025-406189.8SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sendinCVE-2025-406197.5Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actorCVE-2025-40627.8A vulnerability has been found in code-projects Theater Seat Booking System 1.0 and classified as critical. Affected by this vulnerability iCVE-2025-406209.8SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delCVE-2025-406219.8SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and del