https://reddit.com/r/netsec/comments/1wcqbvq/sonicwall_sma1000_cve202615409_ssrf_to_erlang_rce/: 🕵️♂️ SonicWall SMA1000 (CVE-2026-15409): SSRF to Erlang RCE chained into automated DCSync from the appliance
Affected Software
Frequently Asked Questions
Does exploitation require valid SMA1000 credentials?
No. The reported SSRF in the WorkPlace interface is described as unauthenticated.
What internal service does the attack chain rely on after reaching the appliance?
The chain uses the /wsproxy WebSocket endpoint to access a locally bound Erlang distribution node, couchdb@127.0.0.1, on port 1050. It completes the Erlang handshake using a hardcoded cookie and obtains command execution as the couchdb user.
Why does compromise of the appliance create an Active Directory risk?
An operator can read policy_file.xml and decrypt stored LDAP bind passwords using a static AES key recovered from ASAPPasswordUtil.class. The reported activity then used those credentials and domain-controller machine-account hashes to run DCSync against internal domain controllers, including pass-the-hash authentication.
What local artifact is associated with the reported post-exploitation activity?
The reported workflow dropped a standalone Linux build of Impacket secretsdump into /tmp on the appliance before using it against internal domain controllers.