SonicWall urges admins to patch critical RCE flaw in SMA 100 devices

SonicWall has released a security advisory for SMA 100 series appliances addressing CVE-2025-40599, an authenticated arbitrary file upload vulnerability that can enable remote code execution; customers are urged to update to fixed releases, limit remote management, reset credentials, enforce MFA, and check for IoCs. The report also highlights active targeting of SMA 100 devices by an actor tracked as UNC6148, which has deployed the OVERSTEP rootkit (and may deploy Abyss ransomware) after stealing appliance credentials via multiple earlier vulnerabilities.