A security vulnerability in Secure Mobile Access (SMA) 100 series appliances has been fixed by SonicWall. Tracked as CVE-2025-40602, the vulnerability relates to a local privilege escalation case. The vulnerability has been added to the Known Exploited Vulnerabilities catalog by the U.S.
Cybersecurity and Infrastructure Security Agency (CISA). According to CISA, in order to secure their networks, Federal Civilian Executive Branch (FCEB) agencies must implement the fixes by December 24,
2025.
As part of a campaign aimed at dropping a backdoor known as OVERSTEP, Google announced back in July that it was monitoring a cluster called UNC6148 that was targeting fully patched end-of-life SonicWall SMA 100 series devices. As of right now, it's unclear whether these actions are connected to the UNC6 148 campaign.