Post-authentication improper control of generation of code

CVE-2026-15410 is a post-authentication code injection in the Appliance Management Console (AMC) of SonicWall SMA1000 series remote-access gateways — specifically SMA6210, SMA7210, and SMA8200v hardware/virtual appliances running firmware prior to v12.4.3-03453 and v12.5.0-02835. An admin-authenticated session can smuggle shell metacharacters into an AMC handler, yielding arbitrary OS command execution as the appliance service account. CWE-94, vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

The vendor rated it HIGH (7.2) on the strength of the PR:H requirement — you need admin. That rating is technically defensible in isolation and completely wrong in context: CISA added it to KEV on 2026-07-14 the same day it added CVE-2026-15409, an unauthenticated SSRF in the WorkPlace interface on the same box. In-the-wild activity shows the two being chained, which collapses the PR:H prerequisite and turns this into pre-auth RCE on an appliance whose entire job is to sit on the public internet. Vendor severity understates reality by roughly two full CVSS points.

Why this verdict

• KEV + active exploitation: CISA added this on disclosure day; SonicWall PSIRT confirmed in-the-wild use. The PR:H friction that anchored 7.2 is empirically absent in the observed chain.
• Role multiplier — network edge appliance: SMA1000 is a canonical network-edge/remote-access gateway. 100% of production installs occupy the high-value role by definition; RCE on it = fleet-scale VPN credential harvest, session hijack, and network entry. Floor is CRITICAL per the role catalog.
• Chain nullifies auth requirement: CVE-2026-15409 (unauth SSRF, same box, same firmware) is the documented pre-auth on-ramp. Treating 15410 as admin-only is a paper analysis; the working exploit is pre-auth RCE.
• Appliance opacity amplifies persistence risk: No customer-installable EDR on the box; SonicWall's own eviction guidance requires re-image / re-deploy plus credential + TOTP rotation. Discovery lag is real and expensive.
• Patch reversal is trivially fast: Firmware diff between vulnerable and patched builds is the fastest path to a public PoC; expect commodity exploit tooling within 7 days of disclosure.

Why not higher?

There is no higher bucket than CRITICAL, and the 9.4 (not 10.0) reflects that customer-installable compensating controls (source IP allow-listing on the WorkPlace interface, isolating AMC to a management VLAN) do exist and materially reduce blast radius for shops that adopted them.

Why not lower?

Downgrading below CRITICAL would require breaking the role-multiplier floor, which per the hard rule requires explicit installed-base evidence that the high-value role is <10% of installs. For an internet-facing VPN concentrator that is definitionally false — the product's job IS the high-value role. Active KEV exploitation independently forbids a downgrade.

1. Block internet access to the AMC interface immediately — Restrict TCP/8443 (AMC) to a dedicated management CIDR at the upstream firewall. This severs the SSRF→AMC pivot even if you can't patch today. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL — and honestly, within hours given KEV status.
2. Apply firmware 12.4.3-03453 or 12.5.0-02835 — This is the only path that closes CVE-2026-15410 permanently. Schedule the maintenance window this week; ≤ 90 days per the noisgate remediation SLA, but with active exploitation you should target the immediate weekend.
3. Hunt for compromise BEFORE patching — Pull SonicWall audit logs for AMC endpoints with shell metacharacters in parameters, and check WorkPlace document roots for unknown files. If IoCs match SonicWall PSIRT's published list, follow their re-image + credential-rotation runbook — patching alone will not evict a resident attacker.
4. Rotate all SMA1000-issued credentials and TOTP seeds — Assume every credential that traversed the appliance since a plausible compromise date is burned. Force password reset and TOTP re-enrollment for every VPN user on affected appliances.
5. Enable geo/ASN blocking on WorkPlace for the interim — Reduces the pre-auth SSRF attack surface (CVE-2026-15409) while you stage the firmware upgrade. Not a fix — a stopgap.

Run this from an auditor workstation with a SonicWall admin session cookie or API token exported as SMA_TOKEN, targeting the AMC hostname. Example: SMA_TOKEN=xxx ./check-sma1000.sh sma.example.com. Requires curl and jq; no privileges on the appliance itself beyond a read-only admin API session.

#!/usr/bin/env bash
# noisgate check for CVE-2026-15410 (SonicWall SMA1000 AMC code injection)
# Usage: SMA_TOKEN=<admin_api_token> ./check-sma1000.sh <amc-hostname>
set -u

HOST="${1:-}"
TOKEN="${SMA_TOKEN:-}"
if [[ -z "$HOST" || -z "$TOKEN" ]]; then
  echo "Usage: SMA_TOKEN=<token> $0 <amc-hostname>" >&2
  exit 2
fi

# Fixed builds per SonicWall PSIRT SNWLID-2026
FIXED_124="12.4.3-03453"
FIXED_125="12.5.0-02835"

RESP=$(curl -sk --max-time 10 \
  -H "Authorization: Bearer ${TOKEN}" \
  "https://${HOST}:8443/api/v1/system/version")

if [[ -z "$RESP" ]]; then
  echo "UNKNOWN: no response from AMC on ${HOST}:8443"
  exit 3
fi

VER=$(echo "$RESP" | jq -r '.firmware_version // empty' 2>/dev/null)
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse firmware_version from AMC response"
  exit 3
fi

echo "Detected firmware: ${VER}"

# Simple version compare: split on '-' then dotted
ver_ge() {
  # returns 0 if $1 >= $2
  [[ "$1" == "$2" ]] && return 0
  printf '%s\n%s\n' "$2" "$1" | sort -V -C
}

BRANCH="${VER%%.*}.${VER#*.}"; BRANCH="${VER:0:4}"
TARGET=""
case "$BRANCH" in
  12.4*) TARGET="$FIXED_124" ;;
  12.5*) TARGET="$FIXED_125" ;;
  *)     echo "UNKNOWN: unrecognized firmware branch ${BRANCH}"; exit 3 ;;
esac

if ver_ge "$VER" "$TARGET"; then
  echo "PATCHED (>= ${TARGET})"
  exit 0
else
  echo "VULNERABLE (needs >= ${TARGET})"
  exit 1
fi

Sources

1. Help Net Security — CVE-2026-15409/15410 zero-day attacks
2. CISA KEV Catalog
3. SonicWall PSIRT Advisories
4. Cybersecurity Dive — SonicWall SMA1000 exploitation
5. Windows News — CISA adds SonicWall flaws to must-fix list
6. Cybersecurity News — SMA1000 vulnerability internal systems access
7. Cybersecurity Dive — SMA1000 exposed on the internet