remmons-r7/rapid7-cve-2026-15409

This repository is a proof of concept exploit published by security researchers at Rapid7, a well known cybersecurity company. It demonstrates a specific vulnerability, tracked as CVE-2026-15409, in SonicWall SMA 1000, which is a remote access appliance that companies use to let employees connect securely to internal networks. The proof of concept shows how an attacker could get remote code execution, meaning the ability to run arbitrary commands on the target device, without needing root or administrator privileges first. It works by talking to an internal service on the appliance that uses the Erlang programming language's own networking protocol, and reaching that internal service by tunneling the connection through a websocket that the appliance normally exposes for its remote access features. The code is a single Python script that a security researcher runs against a target appliance's address, along with some connection parameters, and an optional command to execute on the remote device. The README also documents notes useful for defenders, including which service and ports are involved, and mentions that an attacker who gains this initial access could potentially escalate to root privileges using a separate, related vulnerability. This is not a general purpose tool. It exists to help security teams understand, test for, and defend against this specific vulnerability in SonicWall SMA 1000 appliances, and it assumes the reader already has authorization to test the systems involved. There is no build process or dependency installation described beyond having Python 3 available, so it is easy to run once a target is identified, but using it responsibly requires understanding the vulnerability and having permission to test the affected system.