# Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

Unauthenticated /wsproxy bypass on SonicWall SMA tunnels to localhost CouchDB and control service, chained with path traversal in execRemoveHotfix for root RCE.

- Payout: Real-world hack
- Severity: critical
- Program: SonicWall SMA
- Found by (vendor credit): Adam Babis of SonicWall PSIRT
- Analysis by: Steven Adair
- Disclosed: 2026-07-17
- CVE: CVE-2026-15409, CVE-2026-15410
- Write-up quality: 9/10
- Original: https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/
- Library page: https://bugbountylibrary.com/r/blog%3Avolexity-com-blog-2026-07-17-proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation
- Tags: area:devices domain:network impact:internal-access impact:privesc impact:rce kind:incident platform:threat-intel sev:critical technique:chained vuln:auth-bypass vuln:command-injection vuln:path-traversal vuln:ssrf

**Target:** SonicWall SMA 1000 series VPN appliance (6210/7210/8200v)
**Root cause:** The /wsproxy endpoint accepts requests with User-Agent 'SMA Connect Agent' and bmID starting with -3389 without a valid session, tunneling WebSockets to localhost-only services. Separately, sysCtrl.execRemoveHotfix builds a rollback path from caller-controlled input without constraining it to the rollback directory, enabling traversal.
**Steps:**
1. Send `GET /wsproxy?bmID=-3389<suffix>&serviceType=SSH&host=0.0.0.0&port=1050` with `User-Agent: SMA Connect Agent`; receive `HTTP/1.1 101 Switching Protocols`.
2. Tunnel to CouchDB on 127.0.0.1:1050 using shipped hardcoded admin:admin credentials.
3. As couchdb user, write `/tmp/1234.sh` that reads `/sys/class/dmi/id/product_uuid`.
4. Derive control-service Basic auth password: strip dashes from product_uuid, Base64-encode.
5. Invoke sysCtrl.execRemoveHotfix with `../../../../../tmp/1234.sh`; helper runs `chmod +x` then `exec /tmp/1234.sh --unattended` as root.
**How found:** Incident response: suspicious authentication and lateral movement from SMA appliances led to log review of extraweb_access.log, where /wsproxy requests with bmID=-3389 and 101 status codes stood out; disk and memory forensics (Surge Collect Pro, Volcano) confirmed compromise and revealed the exploit chain.
**Exploitation:** Attacker used the unauthenticated /wsproxy WebSocket tunnel to reach localhost CouchDB (admin:admin), wrote a script as the couchdb user to read the world-readable product_uuid, derived the control-service password, then invoked execRemoveHotfix with a traversal path to execute the staged script as root. Root access enabled credential theft, tcpdump LDAP sniffing, and lateral movement.
**Escalation:** Chained SSRF tunnel to CouchDB file write, then path traversal in execRemoveHotfix to escalate from couchdb user to root; root used to sniff unencrypted LDAP and pivot into the customer network.
**Insight:** Look for auth gates keyed on spoofable headers (User-Agent) and parameter prefixes (bmID=-3389) that skip session checks; localhost-only services behind such proxies become external attack surface, and default hardware UUIDs make derived passwords guessable.