SonicWall SMA1000 flaws exploited as zero-days to push custom malware
Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances.
Intelligence analysis by Llama
SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks, allowing threat actors to install custom malware on vulnerable VPN appliances. The flaws, tracked as CVE-2026-15409 and CVE-2026-15410, affect SMA1000 6210, 7210, and 8200v appliances.
Imagine you have a super powerful tool that can control your home's security system. But, someone has found a way to hack into that tool and use it to install bad software on your computer. This is what happened with the SonicWall SMA1000 appliances. Hackers found a way to exploit two vulnerabilities in the system and install custom malware on the appliances. This allowed them to access internal applications and potentially spread to other parts of the network.
Analysis
A Critical Vulnerability Chain Exposed
The recent exploitation of two previously undisclosed vulnerabilities in SonicWall SMA1000 appliances has exposed a critical vulnerability chain that has been exploited by threat actors for weeks. The flaws, tracked as CVE-2026-15409 and CVE-2026-15410, affect SMA1000 6210, 7210, and 8200v appliances and have been used to install custom malware on vulnerable VPN appliances.
According to Volexity, a previously unknown threat actor it tracks as UTA0533 began exploiting the vulnerabilities as early as June 22, weeks before SonicWall publicly disclosed the flaws. The attackers first exploited CVE-2026-15409 to abuse the SMA1000's '/wsproxy' endpoint, allowing them to establish unauthenticated WebSocket tunnels to services that should only have been accessible from the appliance itself.
This exposed internal applications, including CouchDB and the VPN device's management service. Using this access, the attackers queried CouchDB to obtain the appliance's 'product_uuid', a value required to complete the second stage of the attack. Volexity says the exact method used to exploit CouchDB remains unknown.
After obtaining the appliance's product_uuid, the attackers exploited the CVE-2026-15410 command injection vulnerability through the Appliance Management Console's 'sysCtrl.execRemoveHotfix' RPC method, allowing them to execute commands as root and take full control of the appliance.
With root access, UTA0533 installed a custom malware dropper that Volexity calls KNUCKLEBALL under the file name 'deploy_new.py'. KNUCKLEBALL is used to deploy two Java-based malware families named Sou5 (agent_wp8.jar) and ORANGETAIL (agent_wp9.jar), designed for SonicWall SMA1000 appliances.
Sou5 functions as a reverse proxy, allowing attackers to tunnel traffic through the compromised appliance and maintain covert access to internal resources. ORANGETAIL is a custom Java webshell that allows attackers to send encrypted Java payloads to the compromised appliance and dynamically execute them within an HTTP session.
The researchers also found that the attackers modified the appliance's nginx configuration to expose the ORANGETAIL webshell remotely and installed ROOTRUN, a privilege-escalation tool that allows commands to be executed as root.
Volexity says that while the campaign and malware showed 'significant' technical sophistication, the threat actor was less successful at spreading into victims' internal networks.
The Importance of Timely Patching
The exploitation of these vulnerabilities highlights the importance of timely patching and the need for organizations to stay vigilant in protecting their networks from zero-day attacks. The use of custom malware and the exploitation of internal applications demonstrate the sophistication of the threat actor and the potential for significant damage if left unpatched.
The Road Ahead
In the wake of this incident, it is essential for organizations to prioritize timely patching and to stay vigilant in protecting their networks from zero-day attacks. The use of custom malware and the exploitation of internal applications demonstrate the sophistication of the threat actor and the potential for significant damage if left unpatched.
Key points
- Two previously undisclosed vulnerabilities in SonicWall SMA1000 appliances were exploited in zero-day attacks for weeks.
- The flaws, tracked as CVE-2026-15409 and CVE-2026-15410, affect SMA1000 6210, 7210, and 8200v appliances.
- The attackers used the vulnerabilities to install custom malware on vulnerable VPN appliances.
- The malware was designed to exploit internal applications and potentially spread to other parts of the network.
- The incident highlights the importance of timely patching and the need for organizations to stay vigilant in protecting their networks from zero-day attacks.
If the affected organizations patch their appliances in a timely manner, they can prevent further exploitation and minimize the damage. Additionally, the disclosure of the vulnerabilities and the exploitation chain can help improve the security of similar systems and prevent similar attacks in the future.
The exploitation of these vulnerabilities highlights the potential for significant damage if left unpatched. The use of custom malware and the exploitation of internal applications demonstrate the sophistication of the threat actor and the potential for further attacks.
