---
title: "Security Bulletin: SonicWall SMA 100 Series Authenticated Arbitrary File Upload Vulnerability"
description: SonicWall SMA 100 Series vulnerability (CVE‑2025‑40599) allows authenticated arbitrary file upload, potentially leading to remote code execution. CVSS 9.1. Patch to firmware 10.2.2.1‑90sv immediately. Ongoing malware campaigns elevate urgency.
---

[Cybersecurity Blog | RedLegg ](https://www.redlegg.com/blog)

# [Security Bulletin: SonicWall SMA 100 Series Authenticated Arbitrary File Upload Vulnerability](https://www.redlegg.com/blog/security-bulletin-sonicwall-sma-100-series-authenticated-arbitrary-file-upload-vulnerability-07-25)

 Written by [RedLegg's Cyber Threat Intelligence Team](https://www.redlegg.com/blog/author/redleggs-cyber-threat-intelligence-team) | 7/25/25 9:13 PM

About:

RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.

## VULNERABILITIES

### SonicWall SMA 100 Series Authenticated Arbitrary File Upload Vulnerability

 

**CVSS Score**: 9.1 (Critical)**  
****Identifier**: CVE‑2025‑40599**  
****Exploit or POC**: No confirmed public exploit  
**Update**:  CVE‑2025‑40599 – [SonicWall Security Advisory SNWLID‑2025‑0014](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0014)

**Description**: CVE‑2025‑40599 is a critical vulnerability affecting SonicWall Secure Mobile Access (SMA) 100 Series appliances, specifically SMA 210, 410, and 500v running firmware versions 10.2.1.15‑81sv or earlier. The flaw is an authenticated arbitrary file upload issue in the SMA web management interface, permitting an administrative user to upload arbitrary files to the system. This can lead to remote code execution when combined with other actions or backdoor deployment.

 

Organizations should note that Google's Threat Intelligence Group has identified ongoing Overstep malware campaigns by threat actor UNC6148 targeting SMA 100 devices, even those updated, and using compromised credentials or potentially zero-day access. The campaign has persisted for six months and indicates possible pre-patch credential theft or additional exploitation vectors. Despite lack of confirmed exploitation via this CVE, the risk environment is considered severe.

 

**Mitigation Recommendation**: 

- Immediately update SMA 100 Series appliances to firmware version 10.2.2.1‑90sv or later. This is the only release known to address CVE‑2025‑40599.
- For virtual appliances (SMA 500v), rebuild from clean VM images: export configs, delete the old VM and disks, deploy a fresh SMA image, and reapply configurations.
- Rotate all administrator passwords and reinitialize One-Time Password (OTP) bindings, even after patching.
- Disable remote management on external‑facing interfaces (e.g. X1) where not needed.
- Enforce Multi‑Factor Authentication (MFA) for all administrator and user access.
- Enable Web Application Firewall (WAF) on appliance management interfaces.

 

 

 

 

[View full post](https://www.redlegg.com/blog/security-bulletin-sonicwall-sma-100-series-authenticated-arbitrary-file-upload-vulnerability-07-25)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "RedLegg's Cyber Threat Intelligence Team"
  },
  "dateModified" : "2025-07-25T21:13:38.224Z",
  "datePublished" : "2025-07-25T21:13:38Z",
  "headline" : "Emergency Security Bulletin: SonicWall SMA 100 Series Authenticated Arbitrary File Upload Vulnerability",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://www.redlegg.com/hubfs/Emergency%20Bulletin%20v2.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.redlegg.com/blog/security-bulletin-sonicwall-sma-100-series-authenticated-arbitrary-file-upload-vulnerability-07-25",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/4675768/logo-red-01.png",
      "width" : 419.66666
    },
    "name" : "RedLegg Cybersecurity Blog"
  }
}
```