SonicWall SMA100 CVE-2025-40603

Exploitation requires an authenticated SonicWall SMA100 administrator (PR:H) with access to the appliance's log files, plus occurrence of the unspecified 'certain conditions' under which partial user credential data is written into those logs (CWE-532). User interaction (UI:R) is required - an administrator must actively access and view the affected log files. Limiting factors that reduce real-world risk: the attacker must already hold high-privilege administrative access (there is no unauthenticated or low-privilege path), the sensitive data is only 'partial' credential material rather than full credentials, and exposure depends on specific non-universal conditions rather than default operation. Affected products are SMA 210, SMA 410, and SMA 500v firmware.

This is a low-to-moderate priority issue, not an urgent one. The signals are largely consistent and all point to limited real-world risk. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R, base 4.5/MEDIUM) requires PR:H - a high-privilege authenticated administrator - plus user interaction (UI:R), which dramatically narrows the attacker population to someone who already holds administrative access to the appliance. EPSS is low (0.48%, 39th percentile), the vulnerability is NOT on the CISA KEV list, and no public exploit code has been identified, so there is no evidence of active or imminent widespread exploitation. The impact is confidentiality-only (C:H/I:N/A:N) and limited to 'partial' credential data per the vendor description, further capping severity. The main caveat: CVSS encodes AV:N (network), while the exposure is credential data written to log files (CWE-532) that an administrator must then view - the 'network' vector reflects remote management access rather than a remotely triggerable exploit primitive, so the practical attack surface is smaller than AV:N alone suggests. No SSVC decision data was provided in the input. Overall this reads as a genuine but defense-in-depth-class disclosure flaw whose primary threat model is a malicious or compromised administrator account, not an external unauthenticated attacker.

An attacker who has already obtained SMA100 administrator credentials (or a compromised admin session) accesses the appliance's log files, where under certain conditions fragments of other users' credential data have been recorded, and harvests that partial credential material for further account compromise. No public exploit code exists, and exploitation is bounded by the need for pre-existing administrative access and the specific logging conditions that must occur.