Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-32819

A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.

CVSS 8.8 · HighBuzz score 30.0

Buzz score

Why this CVE is surfacing

Buzz score total 30.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 8.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
22.0
8 evidence mentions in the snapshot
Diversity score
8.0
3 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
8 source links · newest first
  • SonicWall Updates SMA 100 Appliances to Remove Overstep MalwareSecurityWeek

    The software update includes additional file checks and helps users remove the known rootkit deployed in a recent campaign.

    newswww.securityweek.comSep 24, 2025, 8:28 AM
  • SonicWall Patches Critical SMA 100 Vulnerability, Warns of Recent Malware AttackSecurityWeek

    SonicWall advises organizations to patch SMA 100 appliances and look for IoCs associated with Overstep malware attacks.

    newswww.securityweek.comJul 24, 2025, 10:18 AM
  • SonicWall SMA devices persistently infected with stealthy OVERSTEP backdoor and rootkitHelp Net Security

    Unknown intruders are targeting fully patched end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances and deploying a novel, persistent backdoor / rootkit, analysts with Google’s Threat Intelligence Group (GTIG) have warned. The analysts say UNC6148 – as they dubbed the threat group – is likely financially motivated. “An organization targeted by UNC6148 in May 2025 was posted to the ‘World Leaks’ data leak site (DLS) in June 2025, and UNC6148 activity overlaps with publicly … More →

    newswww.helpnetsecurity.comJul 16, 2025, 4:52 PM
  • SonicWall SMA Appliances Targeted With New ‘Overstep’ MalwareSecurityWeek

    A threat actor that may be financially motivated is targeting SonicWall devices with a backdoor and user-mode rootkit.

    newswww.securityweek.comJul 16, 2025, 2:00 PM
  • Week in review: The impact of a CVE-free future on cyber defense, Patch Tuesday forecastHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What a future without CVEs means for cyber defense For many cybersecurity professionals, the CVE program is the foundation for hands-on cybersecurity practice and crucial benchmarking of security preparedness. May 2025 Patch Tuesday forecast: Panic, change, and hope A bit of chaos ensued in the following weeks with the announcement that MITRE would no longer be supporting the CVE Program … More →

    newswww.helpnetsecurity.comMay 11, 2025, 8:00 AM
  • SonicWall fixed SMA 100 flaws that could be chained to execute arbitrary codeSecurity Affairs

    SonicWall addressed three SMA 100 flaws, including a potential zero-day, that could allow remote code execution if chained. SonicWall patches three SMA 100 vulnerabilities (CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821), including a potential zero-day, that could be chained by a remote attacker to execute arbitrary code. The first flaw, tracked as CVE-2025-32819 (CVSS score of 8.8), is […]

    newssecurityaffairs.comMay 9, 2025, 7:50 AM
  • Possible Zero-Day Patched in SonicWall SMA AppliancesSecurityWeek

    SonicWall patches three SMA 100 vulnerabilities, including a potential zero-day, that could be chained to execute arbitrary code remotely.

    newswww.securityweek.comMay 8, 2025, 12:41 PM
  • Yet another SonicWall SMA100 vulnerability exploited in the wild (CVE-2025-32819)Help Net Security

    SonicWall has fixed multiple vulnerabilities affecting its SMA100 Series devices, one of which (CVE-2025-32819) appears to be a patch bypass for an arbitrary file delete vulnerability that was exploited in zero-day attacks in early 2021, and may have also been leveraged in the wild. The vulnerabilities and the attack chain Sonicwall SMA100 Series appliances provide a unified secure access (VPN) gateway for small and medium-size businesses, and are regularly targeted by attackers. Reported by Rapid7 … More →

    newswww.helpnetsecurity.comMay 8, 2025, 12:27 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence