tc4dy/CVE-2026-15409-15410-Framework
PoC files
6 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a Python-based exploit framework targeting CVE-2026-15409 (SSRF) and CVE-2026-15410 (privilege escalation) in SonicWall SMA1000 appliances. It implements a full attack chain: SSRF via a WebSocket proxy to reach internal Erlang nodes, Erlang RPC authentication using a hardcoded cookie, remote code execution via os:cmd/1, and an optional root privilege escalation. It also includes an SSRF detection module.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-15409 and CVE-2026-15410 targeting SonicWall SMA1000 appliances. The code implements an SSRF-to-Erlang-RCE chain and a privilege escalation module, consistent with the stated vulnerabilities. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed text files (README.md, exploit.py, requirements.txt).
Classification basis and observed behavior
Classification basis
The primary artifact (exploit.py) contains code that actively exploits the vulnerability by establishing a WebSocket tunnel, authenticating to an Erlang node, and executing arbitrary commands. The README describes it as a 'full weaponized exploit' and 'Exploit Framework'. While a detection function exists, the core purpose is exploitation.
README.md:21README.md:49-51exploit.py:635-639Requirements
- Target must be a vulnerable SonicWall SMA1000 appliance (SMA 6210, SMA 7210, SMA 8200v) with the wsproxy endpoint exposed.
README.md:31README.md:44 - The attacker must have network connectivity to the target's HTTPS port (default 443).
exploit.py:553-554
Observed behavior
- Establishes a WebSocket connection to the target's wsproxy endpoint, tunneling to internal Erlang distribution services on port 1050.
exploit.py:550-554README.md:34-35 - Performs an Erlang distribution handshake and authenticates using a hardcoded default cookie (10ecad5b446e86864832904cd439b6b70262).
exploit.py:76exploit.py:556-598 - Executes arbitrary OS commands on the target via Erlang RPC calls to os:cmd/1.
exploit.py:635-639README.md:37 - Optionally escalates privileges to root by writing a script to /var/tmp/ and triggering the AMC remove_hotfix XML-RPC endpoint with a path traversal.
exploit.py:654-683README.md:38 - Includes an SSRF detection function that probes multiple endpoints and parameters to identify the vulnerability without exploitation.
exploit.py:290-382
Behaviors behind the backdoor verdict
Observables
- Hardcoded Credential
- 10ecad5b446e86864832904cd439b6b70262Default Erlang cookie used for authentication to the target Erlang node, as described in the vulnerability documentation.
exploit.py:76 - Command Execution
- os:cmd/1 via Erlang RPCThe exploit executes arbitrary OS commands on the target through the Erlang distribution protocol, which is the intended exploit behavior.
exploit.py:635-639 - Privilege Escalation
- CVE-2026-15410 root escalation via path traversal in AMC remove_hotfixThe exploit writes a script to /var/tmp/ and triggers it through an XML-RPC call with path traversal, matching the described privesc technique.
exploit.py:654-683 - Network Connection
- WebSocket to target appliance on port 443, tunneling to internal Erlang ports 1050/8188The exploit establishes a WebSocket connection to the target's wsproxy endpoint to reach internal Erlang services, as described in the vulnerability chain.
exploit.py:550-554exploit.py:664-665
What the analysis did not establish
- material evidence limitation
- One non-text media file (doublepoc.png, 1,476,928 bytes) was not analyzed.
- Two unclassified files (22,474 bytes total) were not analyzed.
- Two text files (5 total) were omitted from the packet due to size constraints and were not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.