Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief #132 July 16, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we are covering an actively exploited SonicWall Zero Day that turns a trusted remote access appliance into a direct path toward route access, credential theft, and internal network compromise. And the key issue is not simply remote code execution, it is what the appliance already trusts. Sonic Wall has disclosed two vulnerabilities affecting SMA 1000 series remote access appliances. The first, CVE 2026 15409, is a critical server-side request forgery vulnerability with a maximum CVSS score of ten. The second, CVE-2026-15410, is a high severity local privilege escalation flaw. Both have been added to CISA's known exploited vulnerabilities catalog. Confirming that attackers are already using them in real operations, here is how the attack works. The initial entry point is a WebSocket proxy feature called WS Proxy inside the SonicWool Workplace application. This feature is designed to tunnel legitimate TCP traffic to remote systems. But attackers can manipulate it to connect back to localhost, effectively turning the appliance against itself. That gives them access to internal services that were never intended to be exposed to the internet. The attackers then target an Erlang process listening locally on port 1050. Researchers found that this process relies on a hard-coded authentication cookie. That means the attacker does not need valid user credentials. By reaching the service through the SSRF floor, they can execute commands remotely on the appliance, but the attack does not stop there. After gaining code execution, attackers abuse CVE-2026-15410. A path traversal vulnerability in the remove underscore hotfix workflow. By supplying a malicious file path, they can cause an attacker-controlled script to execute with root privileges. The device may then reboot automatically, but the attacker has already crossed the most important boundary. They now control the remote access appliance at the operating system level, and that changes the breach completely. SMA appliances sit between external users and internal enterprise networks. They handle authentication, remote access, session information. And connectivity into protected systems. Researchers observed compromised appliances being used to harvest credentials, session data, and time-based one-time password seeds. Attackers then pivoted directly into active directory environments. In some cases, investigators identified logins from non-corporate device names such as Kali, originating from the appliance itself without an active VPN session. That is not normal remote access. That is the appliance operating as an internal backdoor. The affected products include SonicWall SMA 1000 Series models 6210, 7210, and 8200 V running vulnerable firmware versions. SonicWall's SMA100 Series and Firewall SSLVPN functionality are not affected by this specific chain. But for vulnerable SMA 1000 deployments, the response must be immediate. There is no workaround. First, upgrade to firmware version 12.4.3-03453, 12.5.0-02835, or a later fixed release. Second, review logs for suspicious WS proxy requests, unusual remove underscore hotfix activity, and unexpected NTLM authentications originating from the appliance's internal address. Third, investigate any login from unfamiliar device names, especially where no corresponding VPN session exists. Fourth, if compromise is suspected, Do not stop after patching. Assume that credentials, session information, and MFA seeds may already have been stolen. Reset passwords, re-enroll affected authentication tokens, review newly created accounts, and hunt for lateral movement inside Active Directory. Finally, isolate management interfaces and limit administrative access to trusted internal networks. The strategic lesson is direct. Remote access appliances are not ordinary edge devices. They are identity gateways with trusted access into the enterprise. When attackers compromise that gateway, They do not simply bypass the perimeter, they inherit the trust the perimeter was designed to enforce. And when a public exploit is already circulating, emergency patching is not optional. It is the minimum response. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.