CVE-2026-15409

This repository contains a functional proof-of-concept exploit for CVE-2026-15409, a remote code execution vulnerability in SonicWall SMA 1000 appliances. The exploit leverages an unauthenticated Erlang distribution protocol tunneled over WebSocket to execute arbitrary OS commands via RPC calls to `os:cmd/1`.

This repository provides a functional exploit chain for CVE-2026-15409 (SonicWall SMA1000 SSRF) and CVE-2026-15410 (root privilege escalation). The exploit leverages SSRF to access internal Erlang distribution services, authenticates using a hardcoded cookie, and achieves RCE via Erlang's `os:cmd/1`, then escalates to root via a path traversal in the AMC.

This repository contains a functional exploit chain for CVE-2026-15409 (SonicWall SMA1000 SSRF) and CVE-2026-15410 (root privilege escalation). The exploit leverages SSRF to access internal Erlang distribution services, authenticates using a hardcoded cookie, and achieves RCE via Erlang's `os:cmd/1`. It then chains a path traversal in the AMC for root escalation.

This repository provides a Bash script that scans SonicWall SMA1000 logs for indicators of compromise (IoCs) related to CVE-2026-15409 (SSRF) and CVE-2026-15410 (code injection). The script checks for specific log patterns but does not exploit the vulnerabilities.

This repository provides a safe detection tool for CVE-2026-15409, an unauthenticated SSRF vulnerability in SonicWall SMA1000 Series appliances. The Python script checks for potential SSRF by testing common vulnerable endpoints with a controlled external URL (httpbin.org) and analyzing responses for indicators of SSRF.

This exploit achieves remote code execution (RCE) on SonicWall SMA 1000 appliances by tunneling Erlang distribution protocol traffic through a WebSocket proxy to interact with an internal Erlang node (localhost:1050). It leverages unauthenticated access to the WorkPlace service and hardcoded Erlang node cookies to execute arbitrary commands via RPC calls.

This script detects indicators of compromise (IOCs) for CVE-2026-15409 in SonicWall SMA1000 appliances by analyzing log files and configuration for suspicious patterns, such as malicious API routes and hotfix rollback indicators. It does not exploit the vulnerability but helps identify potential compromise.

This Metasploit module exploits a Server-Side Request Forgery (SSRF) vulnerability in SonicWall SMA1000 WorkPlace's wsproxy service to access an internal Erlang distribution service. It authenticates using a known Erlang cookie and executes arbitrary Unix commands via Erlang RPC calls to os:cmd/1.