SonicWall SMA 1000 zero-days gave attackers root access
Two flaws in SonicWall SMA 1000 VPN gateways let an attacker with no login send one crafted network request and end up in full control of the device as root. Attackers were already using this before SonicWall had a fix ready.
- Severity
- Not scoredNo CVSS score recorded
- Fix
- Not confirmed
- Affects
- SonicWall SMA 1000+2 more
- Exploited
- Yes, in the wild
How it works
- The appliance runs a WorkPlace WebSocket proxy service at /wsproxy that is meant to relay traffic for legitimate remote-access clients.
- An attacker sends it a request disguised as SonicWall's own Connect Agent client, using a specific User-Agent value and a parameter called bmID that starts with -3389.
- That trick makes the proxy open a tunnel straight to internal, localhost-only services the attacker should never be able to reach directly, including an internal messaging port used by the appliance's own software components.
- Through that tunnel, the attacker completes a login handshake to that internal service using a fixed secret value that is the same on every SonicWall SMA 1000 device, then issues commands to run programs and write files.
- That foothold runs as a low-privilege account, but a second, separate flaw in the appliance's hotfix-removal process lets the attacker abuse a file-path weakness to make the system run their planted file as root instead, completing full takeover.
What to do
Check your SMA 1000 appliance's current firmware version in the management console against SonicWall's advisory for CVE-2026-15409 and CVE-2026-15410, since the source does not give an exact affected-version cutoff. Also review appliance logs for unexpected requests to /wsproxy, especially ones carrying a bmID parameter starting with -3389 or an unusual User-Agent mimicking the SMA Connect Agent, and watch for unexplained internal RPC activity.
SonicWall has released patched firmware for SMA 1000 that fixes both vulnerabilities. Apply SonicWall's official patched firmware for your appliance per its advisory as soon as possible. Because both flaws were exploited before a fix existed, treat any exposed appliance as potentially compromised: rotate credentials that were processed through the device, especially directory-service (LDAP) passwords, and look for the malware families named in the report (KnuckleBall, OrangeTail, Suo5) as part of an incident review, following SonicWall's advisory guidance.
Technical details
Affected software: SonicWall SMA 1000, SonicWall SMA Secure Mobile Access, WorkPlace WebSocket proxy
CVE-2026-15409 (CVSS 10.0) is a pre-authentication SSRF-style flaw in the SMA 1000 WorkPlace WebSocket proxy, allowing an unauthenticated request to redirect a WebSocket tunnel to internal, localhost-bound services including the Erlang distribution port. Because that port accepts a hardcoded cookie shared across appliances, the attacker completes the Erlang handshake and issues RPC calls like os:cmd/1 to gain code execution as the low-privilege couchdb user. CVE-2026-15410 is a path traversal issue in ctrl-service's sysCtrl.execRemoveHotfix routine, which the actor abused to make the appliance execute a staged payload as root, escalating the initial foothold to full system compromise.