CVE-2025-40599: SonicWall SMA 210 Firmware

Critical severity, CVSS 9.1. EPSS: 14% chance of exploitation in the next 30 days.

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.

Affected products

• SonicWall SMA 210 Firmware: before 10.2.2.1-90sv (fixed in 10.2.2.1-90sv)
• SonicWall SMA 410 Firmware: before 10.2.2.1-90sv (fixed in 10.2.2.1-90sv)
• SonicWall SMA 500v Firmware: before 10.2.2.1-90sv (fixed in 10.2.2.1-90sv)

Published 2025-07-23. Last modified 2026-06-17.