{"uuid": "9a756868-be35-4b10-a0ba-bcd1f29039ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15409", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/193756", "content": "SonicWall SMA1000 as an internal attack platform: SSRF to Erlang RCE, then DCSync straight off the appliance\nhttps://www.reddit.com/r/redteamsec/comments/1wcqgem/sonicwall_sma1000_as_an_internal_attack_platform/\n\nTradecraft from a real campaign. CVE-2026-15409 is an unauthenticated SSRF in the SMA1000 WorkPlace interface. The /wsproxy WebSocket endpoint reaches a locally bound Erlang node, you complete the distribution handshake with the hardcoded cookie, and os:cmd() gets command exec as couchdb. Rather than pivot to an internal host, the operator kept operations on the appliance. Read policy_file.xml for LDAP binds, decrypted them, dropped a Linux secretsdump build to /tmp and ran DCSync from the edge device itself. The strong version used domain-controller machine-account hashes recovered from LSA secrets for pass-the-hash, since DC computer accounts already hold replication rights. Living on the appliance means no EDR and very little logging on the box. The exploit is a refactor of Rapid7's PoC. Full chain and scripts in the post, for awareness and detection. https://hunt.io/blog/sonicwall-sma1000-uk-council-attack    submitted by    /u/Straight-Practice-99  (https://www.reddit.com/user/Straight-Practice-99) \n [link] (https://hunt.io/blog/sonicwall-sma1000-uk-council-attack)   [comments] (https://www.reddit.com/r/redteamsec/comments/1wcqgem/sonicwall_sma1000_as_an_internal_attack_platform/)", "creation_timestamp": "2026-09-10T23:00:05.920081Z"}