Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
rapid7-CVE-2026-15409 — This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via RPC calls. | Kitploit
This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via RPC calls.
Share
CVE-2026-15409
This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via RPC calls.
This exploit targets the WorkPlace service (usually listening on port 443), likely to be enabled almost all of the time (requires setting up a user auth method like basic AD)
Developed against ex_sra_vm_12.5.0-02002.ova with the June 2026 hotfix applied (latest prior to patch)
Erlang node cookie used for exploitation should be consistent across targets, it's hardcoded for the Erlang process on localhost:1050, based on testing.
Arbitrary bmID values should generally work as long as the value begins with "-3389". Don't write signatures against "serviceType=SSH", since there are alts like TELNET that work too. 0.0.0.0 can be swapped out for alt addr formats as well.
Port 1050 is an exploitation technique, not a hardcoded req for exploitation. EITW was observed targeting port 8188 as well, though it seems easier to just use 1050. There may be other services on different ports that can be exploited too. Code execution in the wild will likely be in other user contexts that aren't couchdb, due to variation in techniques used.
Attacker can privesc to root with "remove hotfix" xmlrpc traversal exploit CVE-2026-15410 (targeting localhost:8188) once a shell is established
remmons-r7/rapid7-cve-2026-15409
