Proxying to Compromise: Sonic Wall Secure Mobile Access 0-day Exploitation
Summary: Volexity investigated two compromised SonicWall Secure Mobile Access VPN appliances, models 6210, 7210 and 8200v, and found a threat actor it tracks as UTA0533 using a chain of multiple zero-day exploits, with the earliest sign of compromise on June 22, 2026. The chain began with a pre-authentication /wsproxy bypass that opened WebSocket tunnels to localhost-only services including CouchDB on port 1050 and the SMA control service on port 8188, and SonicWall disclosed the flaws publicly on July 14, 2026, with a hotfix in versions 12.4.3-03453 and 12.5.0-02835.
What you should know: The control service password was derived from the appliance's product_uuid, a file readable by unprivileged users and set to a common default value across physical appliances at different customers, so a known UUID alone could breach a device without any other exploit. One appliance was rebooted on July 2, 2026, which Volexity assesses likely wiped memory-resident backdoors, and the actor was captured running tcpdump against internal directory servers on TCP port 389.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026