0xBlackash/CVE-2026-15409

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script that checks for the presence of CVE-2026-15409 by sending HTTP requests to a target and analyzing responses for indicators of SSRF. It does not exploit the vulnerability to gain unauthorized access or execute commands.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README documenting CVE-2026-15409 and a Python script that performs safe SSRF detection by sending requests to a public test URL (httpbin.org) and checking for reflected content. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareSonicWall SMA1000 Series
Attack typesServer-Side Request Forgery (SSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script's primary operation is to send crafted requests to a target and analyze the response to detect a vulnerability. It does not contain code to exploit the vulnerability for unauthorized actions, such as accessing internal resources or executing commands. The script's own banner and comments describe it as a 'Safe Checker' that 'Only performs safe detection - NO internal probing'.

cve-2026-15409-checker.py:8-9cve-2026-15409-checker.py:63-66

Requirements

  • Network access to the target SonicWall SMA1000 appliance.cve-2026-15409-checker.py:12-14

Observed behavior

  • Sends HTTP GET requests to a target URL with various query parameters (url, target, redirect, proxy) containing an encoded external URL (https://httpbin.org/ip).cve-2026-15409-checker.py:26-28cve-2026-15409-checker.py:40-45
  • Checks the HTTP response for indicators of SSRF, such as the presence of 'origin', 'httpbin.org', or '"ip"' in the response body.cve-2026-15409-checker.py:63-66
  • Reports whether the target appears vulnerable based on the response analysis.cve-2026-15409-checker.py:99-105
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
https://httpbin.org/ipThe script sends requests to this public test service to detect SSRF by checking if the appliance's IP appears in the response.cve-2026-15409-checker.py:27-28
Ssl Verification Disabled
verify=FalseThe script disables SSL certificate verification, which is a common practice for testing appliances with self-signed certificates but could expose the tester to MITM risks.cve-2026-15409-checker.py:57
Review boundaries

What the analysis did not establish

  • The evidence consists of a README.md and a Python script. No exploit code is present. The script's detection logic is based on generic SSRF indicators and may not be specific to CVE-2026-15409.
  • Only the two text files (README.md and cve-2026-15409-checker.py) were reviewed; no other files were present in the artifact.
  • Binary content was not analyzed, but none was reported in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1