Dataprise Defense Digest: SonicWall SMA 100 Series – OVERSTEP Rootkit & Critical Vulnerabilities

Vulnerability Number: CVE-2024-38475; CVE-2025-40599 (see SNWLID-2025-0015)

Severity Level: Critical (multi-vector)

Executive Summary

Researchers have observed active exploitation campaigns targeting SonicWall Secure Mobile Access (SMA) 100 Series appliances. A user-mode rootkit called OVERSTEP — (deployed by a tracked actor UNC6148) — has been used to maintain persistence on SMA devices, and two key CVEs (CVE-2024-38475 and CVE-2025-40599) are addressed by SonicWall advisories and firmware updates.

Details

Google Threat Intelligence Group (GTIG) and other researchers reported a campaign where attackers exploited CVE-2024-38475 to hijack sessions and then deployed OVERSTEP, a stealthy user-mode rootkit that hides files, removes log entries, and steals credentials and OTP seeds. SonicWall’s PSIRT and support advisories (SNWLID-2024-0018 / SNWLID-2025-0015) and the vendor notice outline the threat, the affected SMA 100 models (SMA 210, 410, 500v), and remediation steps.

CVE-2025-40599 (authenticated arbitrary file upload) is included as a risk (no evidence of active exploitation as of the advisories), and both vulnerabilities are addressed in firmware 10.2.2.2-92sv or higher. The OVERSTEP rootkit can persist across updates and requires a clean rebuild to ensure removal.

Impact

Successful exploitation may result in unauthorized administrator access, persistent remote access via a rootkit backdoor, credential and OTP exfiltration, and potential data theft or lateral movement. Because OVERSTEP modifies boot/OS behaviors and can remove logs, digital forensics are difficult and a full system rebuild is recommended when compromise is suspected.

Mitigation Strategies

• Upgrade Firmware Immediately
  • Apply SonicWall firmware 10.2.2.2-92sv (or later) which includes fixes for CVE-2024-38475 and CVE-2025-40599 and added file checking to remove known rootkit components.
  • Download firmware from MySonicWall and verify checksums.
• For SMA 500v: Replace and Rebuild the Virtual Appliance
  • Power off and delete the current SMA 500v VM (disks and snapshots), deploy a fresh image and do not restore old backups or config files.
• Reset Credentials and OTP Bindings
  • Reset all administrator and user passwords and clear authenticator app bindings so users rebind MFA apps.
• Apply Hardening Measures
  • Disable remote management on WAN interfaces, enforce MFA, rotate certificates/keys, enable WAF where applicable, and collect logs externally.
• Detection and Response
  • Look for indicators of compromise: log gaps/deletions, unexpected reboots, persistent admin sessions, unexplained config changes, or recurring access post-patch.
  • If compromise is suspected, perform a full rebuild and credential rotation.
• Contact SonicWall Support for assistance and provide SMA logs/TSR as requested.

Sources

• SonicWall PSIRT / Support Advisory: Urgent Advisory for Addressing Rootkits and Other Critical Vulnerabilities in SMA 100 Series (Published July 30, 2025; updated Sep 22, 2025) – recommends 10.2.2.2-92sv and details CVE-2024-38475 & CVE-2025-40599.
• SonicWall PSIRT advisory SNWLID-2025-0015
• Google Cloud Threat Intelligence (GTIG) Blog
• BleepingComputer reporting on SonicWall firmware update to remove rootkit malware

Contributing Authors

• Dallas Myers: Director, Cybersecurity Services, Dataprise