« Volver al listado

CVE-2025-40599

Estado: AnalizadaCrítica (9.1)—

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N con PR:H indica explotación de servicio remoto con privilegios administrativos (T1210). La carga de archivos arbitrarios en interfaz web permite web shell (T1505.003) y ejecución de código (T1059).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Disable or Remove Feature or ProgramPrivileged Account ManagementVulnerability ScanningUser Account ManagementThreat Intelligence ProgramRestrict Web-Based Content

Tecnologías afectadas (3)

Sonicwall — SMA 210 FirmwareSonicwall — SMA 410 FirmwareSonicwall — SMA 500v Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-40599",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-40599",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-24T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT@sonicwall.com",
      "affectedData": [
        {
          "vendor": "SonicWall",
          "product": "SMA 100 Series",
          "versions": [
            {
              "status": "affected",
              "version": "10.2.1.15-81sv and earlier versions"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-07-23T14:15:33.090",
  "references": [
    {
      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0014",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "PSIRT@sonicwall.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "PSIRT@sonicwall.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de carga arbitraria de archivos autenticados en la interfaz de administración web de la serie SMA 100. Un atacante remoto con privilegios administrativos puede explotar esta vulnerabilidad para cargar archivos arbitrarios al sistema, lo que podría provocar la ejecución remota de código."
    }
  ],
  "lastModified": "2026-06-17T09:21:48.840",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "786BB26D-B943-4564-B8CC-3260EF2AACED",
              "versionEndExcluding": "10.2.2.1-90sv"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_210:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "51587338-4A5F-41FC-9497-743F061947C2"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "057D8219-D4F0-49FB-8EE4-6BBBDAED49DB",
              "versionEndExcluding": "10.2.2.1-90sv"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_410:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9DFB8FBC-FFA4-4526-B306-D5692A43DC9E"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3418E737-CB38-4736-9725-AD05A1AB29CF",
              "versionEndExcluding": "10.2.2.1-90sv"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sonicwall:sma_500v:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A6AD8A33-7CE4-4C66-9E23-F0C9C9638770"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "PSIRT@sonicwall.com"
}