Ethical Hacking News
SonicWall has addressed critical vulnerabilities in the SMA 100 series, including a zero-day vulnerability that could be chained to execute arbitrary code. This patch is essential for organizations relying on SonicWall's security solutions.
SonicWall has addressed three significant vulnerabilities (CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821) in their SMA 100 series, including a potential zero-day vulnerability that could be chained to execute arbitrary code. The first vulnerability allows a remote authenticated attacker with SSLVPN user privileges to bypass security measures and gain unauthorized access to sensitive data. The second vulnerability enables an authenticated remote attacker to make any directory on the SMA appliance writable. The third vulnerability allows a remote authenticated attacker with SSLVPN admin privileges to inject shell command arguments, posing a significant threat despite its CVSS score of 6.7. Rapid7 researchers discovered and reported these vulnerabilities in April 2025, highlighting their potential severity and the fact that they could be chained to execute arbitrary code. Organizations relying on SonicWall's security solutions must prioritize their cybersecurity posture, ensure up-to-date software patches, and conduct regular vulnerability scanning and penetration testing to mitigate this risk.
SonicWall has addressed three significant vulnerabilities (CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821) in their SMA 100 series, including a potential zero-day vulnerability that could be chained to execute arbitrary code. These patches are crucial for organizations that rely on SonicWall's security solutions, as the vulnerabilities could potentially allow remote attackers to bypass security measures and gain unauthorized access to sensitive data.
The first vulnerability, tracked as CVE-2025-32819, is classified as a Post-Authentication SSLVPN user arbitrary file delete vulnerability. According to SonicWall's advisory, this flaw allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings. This vulnerability has a CVSS score of 8.8, indicating its high severity.
The second vulnerability, tracked as CVE-2025-32820, is classified as a Post-Authentication SSLVPN user Path Traversal issue. An authenticated remote attacker can use path traversal via SSLVPN to make any directory on the SMA appliance writable. This vulnerability has a CVSS score of 8.3, also indicating its high severity.
The third vulnerability, tracked as CVE-2025-32821, is classified as a Post-Authentication SSLVPN admin remote command injection vulnerability. A remote authenticated attacker with SSLVPN admin privileges can inject shell command arguments to upload a file on the appliance. This vulnerability has a CVSS score of 6.7, although still posing a significant threat.
Rapid7 researchers discovered these vulnerabilities in April of 2025 and reported them to SonicWall. According to Rapid7's research, an attacker with SSLVPN access can chain the three flaws to gain admin rights, write to system directories, and achieve root-level RCE (Remote Code Execution). This chain results from a low-privilege session cookie being reset by deleting a database file, followed by making /bin writable, and finally executing a reverse shell payload to achieve root-level remote code execution.
Rapid7's researchers demonstrated a full exploit chain on SonicWall SMA using the three flaws. Their findings highlight the potential severity of this vulnerability. Based on known IOCs (Indicators of Compromise) and Rapid7's incident response investigations, they believe that this vulnerability may have been exploited in attacks in the wild.
The fact that these vulnerabilities could be chained to execute arbitrary code makes them particularly concerning for organizations relying on SonicWall's security solutions. The patch provided by SonicWall addresses these issues, ensuring that organizations are protected from potential exploitation.
In light of this development, it is essential for organizations to prioritize their cybersecurity posture and ensure they have up-to-date software patches in place. Regular vulnerability scanning and penetration testing can help identify potential weaknesses before they become exploited by attackers.
Related Information:
https://www.ethicalhackingnews.com/articles/SonicWall-SMA-100-Vulnerability-Patch-A-Cautionary-Tale-of-Zero-Day-Exploitation-ehn.shtml
https://securityaffairs.com/177626/hacking/sonicwall-fixed-sma-100-flaws-that-could-be-chained-to-execute-arbitrary-code.html
https://nvd.nist.gov/vuln/detail/CVE-2025-32819
https://www.cvedetails.com/cve/CVE-2025-32819/
https://nvd.nist.gov/vuln/detail/CVE-2025-32820
https://www.cvedetails.com/cve/CVE-2025-32820/
https://nvd.nist.gov/vuln/detail/CVE-2025-32821
https://www.cvedetails.com/cve/CVE-2025-32821/
Published: Fri May 9 10:36:04 2025 by llama3.2 3B Q4_K_M
