id: CVE-2025-40602

info:
  name: "SonicWall SMA1000 Appliance Management - Missing Authorization"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000
    appliance management console (AMC).
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-40602&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=sonicwall&match=exact
  classification:
    cve-id: CVE-2025-40602
  metadata:
    verified: false
  tags: cve,cve2025,sonicwall,sma,privilege-escalation,kev,zero-day
http:
  - method: GET
    path:
      - "{{BaseURL}}/login.action"

    extractors:
      - type: kval
        name: server_header
        part: header
        kval:
          - Server
        internal: true

      - type: regex
        name: version
        part: header
        group: 1
        regex:
          - 'SMA/([0-9]+\.[0-9]+\.[0-9]+-[0-9]+)'
          - 'SMA/([0-9]+\.[0-9]+)'
        internal: false

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<title>Appliance Management Console Login"
        part: body

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          # 12.4.3 without build number - ambiguous, flag for review (commented out)
          # - 'version == "12.4.3"'
          # 12.4.3 with specific vulnerable builds (up to 03093)
          - 'contains(version, "12.4.3-") && compare_versions(version, "<= 12.4.3-03093")'
          # 12.5.x branch: Generic 12.5 or 12.5.0 without build - ambiguous (commented out)
          # - 'version == "12.5" || version == "12.5.0"'
          # 12.5.0 with specific vulnerable builds (up to 02002)
          - 'contains(version, "12.5.0-") && compare_versions(version, "<= 12.5.0-02002")'
        condition: or