Double-Zero: Chaining SonicWall SMA 1000 Zero-Days to Unleash Inc Ransomware
(By DigitalSpying Staff)
Executive Summary
In mid-July 2026, the cybersecurity landscape was hit by a pair of sophisticated zero-day vulnerabilities affecting SonicWall’s Secure Mobile Access (SMA) 1000 Series appliances. These vulnerabilities—CVE-2026-15409 (a critical pre-authentication Server-Side Request Forgery) and CVE-2026-15410 (a post-authentication code injection)—allow remote, unauthenticated attackers to gain complete root-level control over compromised security gateways. According to threat intelligence and incident response reports from Rapid7 and subsequent coverage by Dark Reading and The Hacker News, these flaws were actively exploited as zero-days by threat actors associated with the notorious Inc Ransomware RaaS (Ransomware-as-a-Service) group.
This report provides a comprehensive, deep-dive technical breakdown of the exploit chain, details on the threat intelligence context, its operational impact, and immediate, actionable mitigation guidance.
Technical Deep-Dive: Chaining SSRF and Command Injection
The true power of this zero-day campaign lies in how attackers chain these two distinct vulnerabilities together to pivot from a pre-authentication outsider to an absolute system administrator (root).
Phase 1: Pre-Authentication SSRF via /wsproxy (CVE-2026-15409)
* Vulnerability Type: Server-Side Request Forgery (SSRF)
* CVSS Score: 10.0 (Critical)
* Target Application: SonicWall WorkPlace application (default port 443)
* Root Cause: The primary flaw exists within the WebSocket proxy feature, which can be reached via the /wsproxy path. The appliance utilizes this proxy to handle WebSocket requests, but it lacks sufficient access controls and validation for user-supplied URL parameters such as host and port.
* Exploitation Mechanism: An unauthenticated, remote attacker can issue crafted HTTP/WebSocket requests to the /wsproxy endpoint. By specifying local loopback targets (e.g., localhost or 127.0.0.1) in the host parameter, the attacker can establish a netcat-like TCP tunnel bypassing the firewall to communicate directly with internal, gated local services on the device that are otherwise inaccessible from the internet. Specifically, attackers leverage this WebSocket proxy to reach unhardened local services running on loopback, such as:
1. The Erlang application (listening on localhost:1050), which has a hardcoded cookie value. Because the Erlang cookie is static, no authentication is needed to establish code execution inside the Erlang environment.
2. The Control Service (ctrl-service) application (listening on localhost:8188).
Using a python exploit like the one detailed by Rapid7, attackers are able to run commands inside the context of local service users (such as the couchdb user under UID 1010).
Phase 2: Local Privilege Escalation via ctrl-service (CVE-2026-15410)
* Vulnerability Type: Post-Authentication Code Injection / Path Traversal
* CVSS Score: 7.2 (High)
* Target Application: Appliance Management Console (AMC) / Control Service (ctrl-service)
* Root Cause: The Appliance Management Console features a hotfix removal utility (/usr/local/bin/remove_hotfix), managed by ctrl-service on port 8188. This endpoint has a path traversal vulnerability when processing the hotfix request parameter in the remove_hotfix workflow.
* Exploitation Mechanism: Once attackers establish a foothold via the CVE-2026-15409 WebSocket tunnel, they authenticate or directly trigger the local ctrl-service API. An attacker submits a POST request to /rollbackConfirm.action containing path traversal characters in the hotfix parameter (e.g., ../../../../../tmp/malicious.sh). Because this task is handled by a service running as root, the appliance attempts to change permissions and execute the pointed script:
chmod +x /var/lib/aventail/avp/rollback/../../../../../tmp/malicious.sh
/bin/bash /var/lib/aventail/avp/rollback/../../../../../tmp/malicious.sh --unattended
Immediately following the execution, the system issues a reboot command (shutdown -r now), sealing the root-level takeover.
Threat Intelligence & Inc Ransomware Campaign Activity
This double zero-day exploit chain has been central to an active campaign observed by Rapid7 Managed Detection and Response (MDR) and analyzed in depth by SOC Prime. The threat actors are attributed to Inc Ransomware, an extremely aggressive double-extortion Ransomware-as-a-Service (RaaS) group known for targeting large enterprises and critical infrastructure.
The Attack Lifecycle
1. Stealthy Initial Access: The attackers identify internet-facing SMA 1000 series perimeter appliances. They exploit the chained vulnerabilities to bypass input validation and execute OS commands without raising firewall alerts.
2. Credential Harvesting & Persistence: Instead of jumping immediately to ransomware, the adversaries focus on ensuring persistent access that can survive a reboot or standard network-level mitigations. They systematically extract high-value corporate credentials, active session databases (such as /tmp/temp.db*), and multi-factor authentication (MFA) seeds used for Time-Based One-Time Password (TOTP) configurations.
3. Direct Active Directory Compromise: A unique and highly sophisticated behavior observed in this campaign involves direct, machine-level lateral movement. Using the compromised SMA appliance’s internal IP address, the threat actors initiate anomalous Active Directory (AD) authentications directly against core domain controllers.
* No VPN tunnel is created. The authentications are sent via the integrated LDAP service account configured on the appliance.
* These attempts utilize attacker-controlled, non-corporate workstation client names (such as kali).
* Because the appliance is typically highly trusted inside the network, it serves as an unmonitored backdoor, bypassing standard network detection mechanisms.
4. Exfiltration & Encryption: After lateral movement and credential sweeping, the attackers move to exfiltrate vast amounts of corporate data before deploying the Inc Ransomware payload, initiating double-extortion demands.
Industry Impact & Threat Scope
SonicWall SMA 1000 series appliances (specifically models 6210, 7210, and 8200v) are marketed as premium secure remote access solutions for government agencies, managed service providers (MSSPs), and large multinational corporations. Consequently, this campaign targets high-value, highly sensitive networks.
Due to the severe threat, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVE-2026-15409 and CVE-2026-15410 to its Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026, ordering federal agencies to remediate the vulnerabilities on an emergency basis (The Hacker News).
Experts note that security gateways and edge firewalls are continuously targeted by advanced ransomware groups because compromising the edge bypasses traditional endpoint security.
Actionable Mitigations & Incident Response Guidance
Because threat actors have been actively exploiting these zero-days prior to public disclosure, simply applying the vendor patch is not enough. Compromised appliances may already have backdoors or harvested credentials.
Step 1: Deploy Firmware Updates Immediately
Administrators must immediately upgrade all SonicWall SMA 1000 Series appliances to the following fixed versions:
* SMA 12.4.3-03453 (platform-hotfix) or later.
* SMA 12.5.0-02835 (platform-hotfix) or later.
Note: These vulnerabilities do not affect SSL VPNs on SonicWall firewall models or the SMA 100 series line.
Step 2: Hunt for Indicators of Compromise (IoCs)
Search web application and system logs for the following malicious footprints:
* WebSocket Tunneling (CVE-2026-15409): Look in extraweb_access.log for requests containing GET AND /wsproxy AND =-3389 AND status 101. Pay special attention if parameter values like localhost or ::ffff:127.0.0.1 are present.
* Hotfix Exploit (CVE-2026-15410): Look in ctrl-service.log for the invocation of /usr/local/bin/remove_hotfix containing path traversal names (e.g., ../../../../tmp/).
* Sensitive Path Access: Search logs for access to sensitive paths, particularly /tmp/temp.db* or requests to non-existent URIs like /__api__/login or /__api__/logout returning HTTP 200.
* Configuration Alterations: Verify if /var/lib/unit/conf.json contains routes for /__api__/login or /__api__/logout. These do not exist in standard configurations.
* Active Directory Logs: Search domain controller security logs for Event ID 4624 (Logon Type 3) originating from the SMA appliance's internal IP address using anomalous workstation names (e.g., kali, localhost, DESKTOP-KRLUI3J, DESKTOP-IC3C80F, DESKTOP-5P0TSCP).
Step 3: Eviction and Reconstruction (If Compromised)
If any of the above indicators are discovered, the appliance must be treated as completely compromised. Apply the following steps:
1. Re-image or Redeploy: Re-image physical SMA hardware or redeploy virtual appliances entirely from scratch. Attackers have been observed rolling back new patches to vulnerable states to maintain persistence if they are not fully evicted.
2. Rotate All Passwords: Change all user and administrative passwords associated with the appliance and any integrated directory services (e.g., LDAP/Active Directory).
3. Reset MFA Seeds: Invalidate and reset all Time-Based One-Time Password (TOTP) configurations to revoke stolen MFA tokens.
References and Sources
For more information, consult the following original analyses:
* Dark Reading: Inc Ransomware Exploits SonicWall SMA Zero-Days
* The Hacker News: Two SonicWall SMA 1000 Zero-Days Exploited
* SOC Prime: CVE-2026-15410 and CVE-2026-15409 Analysis
* Rapid7: Emergent Threat Response - SonicWall SMA1000 Zero-Days Actively Exploited