{"uuid": "6ea5b5de-c13f-4f8d-8ab5-3fa81c57411d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15409", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Ryan Emmons\", \"Deral Heiland\", \"Rapid7 Vulnerability Research\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Server-Side Request Forgery (SSRF)\\n          vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service to\\n          access the internal Erlang distribution service.\\n\\n          After authenticating using the known Erlang distribution cookie, the\\n          module invokes os:cmd/1 through Erlang RPC to execute arbitrary Unix\\n          commands in the context of the vulnerable SMA service.\\n\\n          The check method performs a benign Erlang node RPC rather than\\n          executing an operating system command.\", \"disclosure_date\": \"2026-07-14\", \"fullname\": \"exploit/linux/http/sonicwall_sma1000_wsproxy_rce\", \"is_install_path\": true, \"mod_time\": \"2026-07-29 15:13:38 +0000\", \"name\": \"SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/sonicwall_sma1000_wsproxy_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/sonicwall_sma1000_wsproxy_rce\", \"references\": [\"CVE-2026-15409\", \"URL-https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008\", \"URL-https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410/\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:55.811149Z"}