Analysis Summary

CVE-2025-23010 CVSS:6.5

An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows a malicious user to manipulate file paths.

CVE-2025-23008 CVSS:7.2

An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged malicious user to modify configurations.

CVE-2025-23009 CVSS:5.9

A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows a malicious user to trigger an arbitrary file deletion.

Impact

• Privilege Escalation
• Data Manipulation

Indicators of Compromise

CVE

• CVE-2025-23010

• CVE-2025-23008

• CVE-2025-23009

Affected Vendors

Remediation

Refer to SonicWall Security Advisory for patch, upgrade, or suggested workaround information.

SonicWall Security Advisory