CVE-2026-15409

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 (affected versions not specified) sonicwall sma6210 firmware versions 12.4.3-03245 through 12.5.0-02624 sonicwall sma7210 firmware (affected versions not specified) sonicwall sma8200v (affected versions not specified)

Description An unauthenticated server-side request forgery (SSRF) issue exists in the SMA1000 Appliance Work Place interface due to insufficient server-side request validation. This flaw allows a remote attacker to force the appliance to make requests to unintended locations. Specifically, attackers can use the public /wsproxy WebSocket endpoint to access services on the appliance local interface. In real-world incidents, this was exploited by tunneling to an Erlang distribution node on local port 1050 to achieve command execution. Attackers have used this to extract policy file.xml, recover LDAP configurations, and decrypt passwords using a static AES key. These compromised appliances then served as platforms for further internal attacks, including credential dumping and domain replication against Active Directory environments across multiple countries and sectors, including government, healthcare, and financial services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /wsproxy WebSocket endpoint to minimize the risk of exploitation.