Skip to content

Back to the catalog

Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days Being Actively Exploited (CVE-2026-15409, CVE-2026-15410)
rapid7.comwriteup

Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days Being Actively Exploited (CVE-2026-15409, CVE-2026-15410)

Rapid7's MDR team details active zero-day exploitation of SonicWall SMA1000 appliances via CVE-2026-15409 (unauthenticated SSRF in the /wsproxy websocket proxy, CVSS 10.0) chained with CVE-2026-15410 (local privilege escalation via path traversal in the ctrl-service remove_hotfix workflow) to achieve root RCE. The post includes a working Python exploit against the localhost Erlang service on port 1050 (using a hardcoded authentication cookie), an HTTP request PoC for the hotfix path-traversal chain, and extensive observed post-exploitation activity — credential/TOTP theft, VPN-less lateral movement to domain controllers via harvested LDAP service accounts — plus concrete log/IOC signatures and attacker-infrastructure IPs (FNS Holdings Limited ASN 206092) for hunting.

TL;DR Rapid7 discovered and reverse-engineered an in-the-wild SonicWall SMA1000 zero-day chain (CVE-2026-15409 SSRF + CVE-2026-15410 privesc) enabling unauthenticated root RCE, publishing exploit code and detailed IOCs.
Open original ↗
Document

What it is

Two actively exploited SonicWall SMA1000 zero-days disclosed July 14, 2026, both now in CISA's KEV catalog. CVE-2026-15409 (SSRF, CVSS 10.0) is chained with CVE-2026-15410 (code injection / path-traversal privilege escalation) for unauthenticated root RCE. Affects SMA1000 models 6210, 7210, and 8200v only — SonicWall firewall SSL VPN and the SMA 100 Series are not affected.

Preconditions / Affected

Vulnerable versions:

  • 12.4.3-03245, 12.4.3-03387, 12.4.3-03434 (platform-hotfix)
  • 12.5.0-02283, 12.5.0-02624, 12.5.0-02800 (platform-hotfix)

The appliance must be internet-facing on port 443. The privesc stage reaches ctrl-service on localhost:8188 (via the SSRF tunnel or the web console); the RCE stage targets the Erlang service on localhost:1050.

What to do

Upgrade to the latest platform hotfix immediately — there are no workarounds. Because exploitation is confirmed, patching alone is insufficient: SonicWall advises forensic review, re-imaging/redeploying compromised appliances, rotating user and admin passwords, and resetting TOTP tokens.

Hunt for these log signatures the summary omits:

  • extraweb_access.log: GET + wsproxy + =-3389 + 101 (HTTP 101 upgrade), especially with host params localhost or ::ffff:127.0.0.1. Note serviceType=TELNET is a viable alternative to SSH.
  • ctrl-service.log: /usr/local/bin/remove_hotfix invoked with traversal sequences to staged scripts (e.g. ../../../../../../tmp/sma1000_5c47.sh).
  • Probing of /auth1.html, /.env, /api/sonicos/is-sslvpn-enabled, and auth API hits at /__api__/logon/<session-id>/authenticate.
  • Access to /tmp/temp.db* (session-data theft).
  • Windows Event ID 4624, logon type 3 (NTLM) into domain controllers sourced from the appliance's internal IP with non-inventory workstation names.
  • Config artifact: /var/lib/unit/conf.json containing routes for /__api__/login or /__api__/logout — these are absent from legitimate configs.

Attacker asset names to match: DESKTOP-KRLUI3J, DESKTOP-IC3C80F, DESKTOP-5P0TSCP, KALI, localhost. Consider blocking FNS Holdings Limited (ASN 206092): 45.131.194.0/24, 45.146.54.0/24, 63.135.161.0/24, 173.239.211.0/24, plus 193.37.32.179/.214 and 216.73.163.151/.158.

Exploit command form (hardcoded Erlang cookie, no auth needed):

python3 cve-2026-15409.py --ws-url 'wss://192.168.1.46/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=0.0.0.0&port=1050' --ws-user-agent 'SMA Connect Agent' --ws-insecure-tls --cookie 10ecad5b446e86864832904cd439b6b70262 --exec 'whoami && id && pwd && hostname'

Caveats

Initial RCE lands as the unprivileged couchdb user (uid 1010); root requires the second CVE. The privesc script only runs — and reboots the box — if the referenced file already exists on disk. A Metasploit module for the full chain is still in development. Authenticated InsightVM/Nexpose/Exposure Command checks shipped in the July 15 content release.

Organisations named here

  • F.N.S Holdings Limited

CVEs named here

  • CVE-2026-15409
  • CVE-2026-15410

Technologies named here

  • cve-2026-15409.py
  • SonicWall SMA1000 Series
  • Metasploit module
  • pspy
  • Exposure Command
  • InsightVM
  • Nexpose
  • Metasploit
  • Python
  • Active Directory
  • CISA KEV
  • LDAP
  • SonicWall

Techniques named here

  • Websocket-based SSRF tunnel abuse
  • Path traversal to arbitrary root code execution
  • Credential and session artifact harvesting
  • Lateral movement via stolen service account
  • Internet-facing enumeration/probing
  • SSRF
  • Path traversal

Threat actors named here

  • Unnamed threat actor observed by Rapid7 MDR

Related in AppSec