{"id":591,"date":"2026-07-15T20:11:30","date_gmt":"2026-07-15T11:11:30","guid":{"rendered":"https:\/\/onepress.co.kr\/index.php\/briefing\/2026-07-15-sonicwall-sma1000-active-exploitation-check-vi\/"},"modified":"2026-07-15T20:11:30","modified_gmt":"2026-07-15T11:11:30","slug":"2026-07-15-sonicwall-sma1000-active-exploitation-check-vi","status":"publish","type":"briefing","link":"https:\/\/onepress.co.kr\/index.php\/briefing\/2026-07-15-sonicwall-sma1000-active-exploitation-check-vi\/","title":{"rendered":"L\u1ed7 h\u1ed5ng SonicWall SMA 1000 \u0111ang b\u1ecb khai th\u00e1c: v\u00e1 xong v\u1eabn ph\u1ea3i ki\u1ec3m tra d\u1ea5u v\u1ebft x\u00e2m nh\u1eadp"},"content":{"rendered":"<figure class=\"wp-block-image size-large\">\n  <img decoding=\"async\" src=\"https:\/\/onepress.co.kr\/wp-content\/uploads\/2026\/07\/sonicwall-sma1000-incident-response-scene.png\" alt=\"Qu\u1ea3n tr\u1ecb vi\u00ean ki\u1ec3m tra thi\u1ebft b\u1ecb truy c\u1eadp t\u1eeb xa v\u00e0 nh\u1eadt k\u00fd trong ph\u00f2ng m\u00e1y ch\u1ee7\" \/><figcaption>H\u00ecnh ONEPRESS v\u1ec1 c\u00f4ng ngh\u1ec7 v\u00e0 an to\u00e0n c\u00f4ng c\u1ed9ng, t\u1eadp trung v\u00e0o vi\u1ec7c ki\u1ec3m tra phi\u00ean b\u1ea3n v\u00e0 nh\u1eadt k\u00fd trong m\u00f4i tr\u01b0\u1eddng v\u1eadn h\u00e0nh th\u1ef1c t\u1ebf.<\/figcaption><\/figure>\n<ul>\n<li><strong>Th\u1eddi \u0111i\u1ec3m ki\u1ec3m tra:<\/strong> 2026-07-15 20:11 KST<\/li>\n<li><strong>C\u01a1 s\u1edf x\u00e1c minh:<\/strong> Th\u00f4ng b\u00e1o s\u1ea3n ph\u1ea9m v\u00e0 h\u01b0\u1edbng d\u1eabn PSIRT c\u1ee7a SonicWall ng\u00e0y 14\/7, \u0111\u1ed1i chi\u1ebfu v\u1edbi KEV c\u1ee7a CISA<\/li>\n<\/ul>\n<h2>\u0110i\u1ec1u g\u00ec \u0111\u00e3 thay \u0111\u1ed5i<\/h2>\n<p><strong>SonicWall x\u00e1c nh\u1eadn ng\u00e0y 14\/7 r\u1eb1ng CVE-2026-15409 v\u00e0 CVE-2026-15410 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn SMA 1000 Series \u0111ang b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf.<\/strong> L\u1ed7 h\u1ed5ng \u0111\u1ea7u l\u00e0 SSRF, CVSS 10,0. L\u1ed7 h\u1ed5ng sau l\u00e0 ch\u00e8n m\u00e3, trong m\u1ed9t s\u1ed1 \u0111i\u1ec1u ki\u1ec7n cho ph\u00e9p qu\u1ea3n tr\u1ecb vi\u00ean \u0111\u00e3 x\u00e1c th\u1ef1c ch\u1ea1y l\u1ec7nh h\u1ec7 \u0111i\u1ec1u h\u00e0nh, CVSS 7,2. CISA \u0111\u00e3 th\u00eam c\u1ea3 hai v\u00e0o KEV.<\/p>\n<p>\u0110\u00e2y kh\u00f4ng ph\u1ea3i th\u00f4ng b\u00e1o c\u1eadp nh\u1eadt th\u00f4ng th\u01b0\u1eddng. SonicWall y\u00eau c\u1ea7u c\u00e0i hotfix m\u1edbi nh\u1ea5t v\u00e0 ph\u00e2n t\u00edch \u0111i\u1ec1u tra c\u00e1c ch\u1ec9 b\u00e1o x\u00e2m nh\u1eadp. N\u1ebfu ph\u00e1t hi\u1ec7n ch\u1ec9 b\u00e1o, thi\u1ebft b\u1ecb v\u1eadt l\u00fd ph\u1ea3i \u0111\u01b0\u1ee3c t\u1ea1o \u1ea3nh l\u1ea1i, thi\u1ebft b\u1ecb \u1ea3o ph\u1ea3i tri\u1ec3n khai l\u1ea1i, \u0111\u1ed3ng th\u1eddi \u0111\u1ed5i m\u1eadt kh\u1ea9u ng\u01b0\u1eddi d\u00f9ng v\u00e0 qu\u1ea3n tr\u1ecb vi\u00ean, \u0111\u1eb7t l\u1ea1i token TOTP.<\/p>\n<p><strong>\u0110\u00e3 v\u00e1 kh\u00f4ng \u0111\u1ed3ng ngh\u0129a \u0111\u00e3 s\u1ea1ch.<\/strong> V\u00ec \u0111\u00e2y l\u00e0 thi\u1ebft b\u1ecb bi\u00ean \u0111ang b\u1ecb khai th\u00e1c, c\u1ea7n x\u1eed l\u00fd x\u00e1c minh phi\u00ean b\u1ea3n, b\u1ea3o to\u00e0n b\u1eb1ng ch\u1ee9ng, ki\u1ec3m tra nh\u1eadt k\u00fd v\u00e0 c\u1ea5u h\u00ecnh, c\u00f9ng vi\u1ec7c x\u00e2y d\u1ef1ng l\u1ea1i khi c\u1ea7n nh\u01b0 m\u1ed9t nhi\u1ec7m v\u1ee5 duy nh\u1ea5t.<\/p>\n<h2>S\u1ea3n ph\u1ea9m v\u00e0 b\u1ea3n d\u1ef1ng b\u1ecb \u1ea3nh h\u01b0\u1edfng<\/h2>\n<ul>\n<li><strong>S\u1ea3n ph\u1ea9m:<\/strong> SMA 1000 m\u1eabu 6210, 7210, 8200v v\u00e0 CMS tr\u00ean m\u1ecdi hypervisor.<\/li>\n<li><strong>12.4.3 b\u1ecb \u1ea3nh h\u01b0\u1edfng:<\/strong> 12.4.3-03245, 12.4.3-03387, 12.4.3-03434.<\/li>\n<li><strong>12.5.0 b\u1ecb \u1ea3nh h\u01b0\u1edfng:<\/strong> 12.5.0-02283, 12.5.0-02624, 12.5.0-02800.<\/li>\n<li><strong>M\u1ed1c \u0111\u00e3 s\u1eeda:<\/strong> 12.4.3-03453 tr\u1edf l\u00ean ho\u1eb7c 12.5.0-02835 tr\u1edf l\u00ean. Ph\u1ea3i ki\u1ec3m tra to\u00e0n b\u1ed9 s\u1ed1 b\u1ea3n d\u1ef1ng hotfix.<\/li>\n<li><strong>Ph\u1ea1m vi:<\/strong> th\u00f4ng b\u00e1o n\u00e0y d\u00e0nh cho SMA 1000, kh\u00f4ng kh\u1eb3ng \u0111\u1ecbnh m\u1ecdi t\u01b0\u1eddng l\u1eeda SonicWall hay d\u00f2ng SMA 100 \u0111\u1ec1u ch\u1ecbu c\u00f9ng l\u1ed7 h\u1ed5ng.<\/li>\n<\/ul>\n<h2>B\u1ea3y b\u01b0\u1edbc c\u1ea7n l\u00e0m h\u00f4m nay<\/h2>\n<ol>\n<li><strong>Ki\u1ec3m k\u00ea:<\/strong> li\u1ec7t k\u00ea t\u1eebng SMA 1000 v\u00e0 CMS v\u1eadt l\u00fd ho\u1eb7c \u1ea3o c\u00f9ng m\u1eabu, b\u1ea3n d\u1ef1ng \u0111\u1ea7y \u0111\u1ee7, \u0111\u1ecba ch\u1ec9 c\u00f4ng khai, ch\u1ee7 s\u1edf h\u1eefu, nh\u00e0 cung c\u1ea5p v\u00e0 v\u1ecb tr\u00ed sao l\u01b0u.<\/li>\n<li><strong>\u0110\u1ecdc b\u1ea3n hotfix \u0111\u1ea7y \u0111\u1ee7:<\/strong> AMC d\u00f9ng System Configuration \u2192 Maintenance v\u00e0 hotfixes; CMC d\u00f9ng Maintain \u2192 Maintain Server v\u00e0 hotfixes. L\u01b0u \u1ea3nh ho\u1eb7c h\u1ed3 s\u01a1 thay \u0111\u1ed5i.<\/li>\n<li><strong>C\u00e0i hotfix m\u1edbi nh\u1ea5t:<\/strong> l\u1ea5y \u0111\u00fang b\u1ea3n hi\u1ec7n h\u00e0nh t\u1eeb MySonicWall sau khi x\u00e1c nh\u1eadn ph\u00ea duy\u1ec7t, t\u00ednh li\u00ean t\u1ee5c d\u1ecbch v\u1ee5, sao l\u01b0u v\u00e0 \u0111\u01b0\u1eddng kh\u00f4i ph\u1ee5c.<\/li>\n<li><strong>B\u1ea3o to\u00e0n b\u1eb1ng ch\u1ee9ng tr\u01b0\u1edbc:<\/strong> l\u01b0u extraweb_access.log, ctrl-service.log, nh\u1eadt k\u00fd ki\u1ec3m to\u00e1n v\u00e0 x\u00e1c th\u1ef1c, c\u1ea5u h\u00ecnh hi\u1ec7n t\u1ea1i, th\u1eddi gian v\u00e0 hash tr\u01b0\u1edbc khi c\u1eadp nh\u1eadt hay kh\u1edfi \u0111\u1ed9ng l\u1ea1i.<\/li>\n<li><strong>Ki\u1ec3m tra IoC ch\u00ednh th\u1ee9c:<\/strong> t\u00ecm HTTP 200 t\u1edbi \/_api_\/login ho\u1eb7c \/__api__\/logout; \/wsproxy c\u00f3 tham s\u1ed1 host \u0111\u00e1ng ng\u1edd v\u00e0 HTTP 101; \u201chotfix removal\u201d k\u00e8m t\u00ean traversal trong ctrl-service.log; v\u00e0 route \/__api__\/login ho\u1eb7c \/__api__\/logout trong \/var\/lib\/unit\/conf.json.<\/li>\n<li><strong>N\u00e2ng th\u00e0nh \u1ee9ng ph\u00f3 s\u1ef1 c\u1ed1 n\u1ebfu c\u00f3 d\u1ea5u v\u1ebft:<\/strong> t\u1ea1o \u1ea3nh l\u1ea1i thi\u1ebft b\u1ecb v\u1eadt l\u00fd ho\u1eb7c tri\u1ec3n khai l\u1ea1i thi\u1ebft b\u1ecb \u1ea3o t\u1eeb ngu\u1ed3n tin c\u1eady; \u0111\u1ed5i m\u1eadt kh\u1ea9u, \u0111\u1eb7t l\u1ea1i TOTP v\u00e0 ki\u1ec3m tra phi\u00ean, \u0111\u0103ng nh\u1eadp, thay \u0111\u1ed5i quy\u1ec1n b\u1ea5t th\u01b0\u1eddng \u1edf h\u1ec7 th\u1ed1ng ph\u00eda sau.<\/li>\n<li><strong>Th\u1eed \u0111\u01b0\u1eddng d\u00f9ng th\u1eadt:<\/strong> ki\u1ec3m tra \u0111\u0103ng nh\u1eadp t\u1eeb xa, MFA\/TOTP, truy c\u1eadp \u1ee9ng d\u1ee5ng, \u0111\u0103ng xu\u1ea5t, qu\u1ea3n tr\u1ecb v\u00e0 chuy\u1ec3n ti\u1ebfp log; ghi l\u1ea1i k\u1ebft qu\u1ea3 theo t\u1eebng thi\u1ebft b\u1ecb.<\/li>\n<\/ol>\n<h2>B\u1ea3n sao l\u01b0u v\u00e0 t\u00ednh li\u00ean t\u1ee5c<\/h2>\n<ul>\n<li>N\u1ebfu c\u00f3 IoC, SonicWall y\u00eau c\u1ea7u b\u1ea3n sao c\u1ea5u h\u00ecnh ph\u1ea3i c\u00f3 t\u1eeb tr\u01b0\u1edbc hotfix th\u00e1ng 12 l\u00e0 12.4.3-03245 ho\u1eb7c 12.5.0-02283.<\/li>\n<li>N\u1ebfu kh\u00f4ng c\u00f3 b\u1ea3n c\u0169 h\u01a1n, ph\u1ea3i ki\u1ec3m to\u00e1n c\u1ea5u h\u00ecnh \u0111\u1ec3 t\u00ecm s\u1eeda \u0111\u1ed5i tr\u00e1i ph\u00e9p. Kh\u00f4i ph\u1ee5c c\u1ea5u h\u00ecnh b\u1ecb can thi\u1ec7p c\u00f3 th\u1ec3 l\u00e0m m\u1ea5t gi\u00e1 tr\u1ecb c\u1ee7a vi\u1ec7c x\u00e2y d\u1ef1ng s\u1ea1ch.<\/li>\n<li>Tr\u01b0\u1edbc khi t\u1ea1o \u1ea3nh l\u1ea1i, x\u00e1c nh\u1eadn HA, t\u00edch h\u1ee3p danh t\u00ednh, ch\u1ee9ng ch\u1ec9, \u0111\u1ecbnh tuy\u1ebfn, ch\u00ednh s\u00e1ch, gi\u1ea5y ph\u00e9p, console v\u00e0 ng\u01b0\u1eddi ch\u1ecbu tr\u00e1ch nhi\u1ec7m kh\u00f4i ph\u1ee5c.<\/li>\n<\/ul>\n<h2>Hi\u1ec3u c\u1ea3nh b\u00e1o \u0111\u00fang m\u1ee9c<\/h2>\n<ul>\n<li>Khai th\u00e1c th\u1ef1c t\u1ebf kh\u00f4ng ch\u1ee9ng minh m\u1ecdi SMA 1000 \u0111\u00e3 b\u1ecb x\u00e2m nh\u1eadp; c\u1ea7n b\u1eb1ng ch\u1ee9ng log v\u00e0 c\u1ea5u h\u00ecnh c\u1ee7a t\u1eebng thi\u1ebft b\u1ecb.<\/li>\n<li>Hotfix c\u0169ng kh\u00f4ng ch\u1ee9ng minh thi\u1ebft b\u1ecb s\u1ea1ch tr\u01b0\u1edbc l\u00fac c\u00e0i. \u0110\u00f3 l\u00e0 l\u00fd do h\u00e3ng y\u00eau c\u1ea7u ph\u00e2n t\u00edch \u0111i\u1ec1u tra.<\/li>\n<li>H\u1ea1n 17\/7 c\u1ee7a CISA \u00e1p d\u1ee5ng cho c\u01a1 quan d\u00e2n s\u1ef1 li\u00ean bang M\u1ef9, kh\u00f4ng ph\u1ea3i h\u1ea1n ph\u00e1p l\u00fd to\u00e0n c\u1ea7u, nh\u01b0ng l\u00e0 t\u00edn hi\u1ec7u \u01b0u ti\u00ean m\u1ea1nh.<\/li>\n<li>Th\u00f4ng b\u00e1o ch\u00ednh th\u1ee9c kh\u00f4ng n\u00eau n\u1ea1n nh\u00e2n hay t\u00e1c nh\u00e2n; kh\u00f4ng suy \u0111o\u00e1n s\u1ed1 v\u1ee5 ho\u1eb7c quy k\u1ebft khi ch\u01b0a c\u00f3 ngu\u1ed3n.<\/li>\n<\/ul>\n<h2>Ngu\u1ed3n ch\u00ednh th\u1ee9c<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.sonicwall.com\/support\/notices\/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities\/kA1VN000001nv6D0AQ\" target=\"_blank\" rel=\"noopener noreferrer\">SonicWall product notice: SMA 1000 Series affected by multiple vulnerabilities<\/a><\/li>\n<li><a href=\"https:\/\/psirt.global.sonicwall.com\/vuln-detail\/SNWLID-2026-0008\" target=\"_blank\" rel=\"noopener noreferrer\">SonicWall PSIRT advisory SNWLID-2026-0008<\/a><\/li>\n<li><a href=\"https:\/\/www.sonicwall.com\/support\/knowledge-base\/kA1VN000001o3Wn0AI\" target=\"_blank\" rel=\"noopener noreferrer\">SonicWall: verify the SMA1000 hotfix version in AMC\/CMC<\/a><\/li>\n<li><a href=\"https:\/\/www.sonicwall.com\/support\/knowledge-base\/kA1VN000001nTwL0AU\" target=\"_blank\" rel=\"noopener noreferrer\">SonicWall: re-image SMA6210\/SMA7210 hardware appliances<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/feeds\/known_exploited_vulnerabilities.json\" target=\"_blank\" rel=\"noopener noreferrer\">CISA Known Exploited Vulnerabilities JSON feed<\/a><\/li>\n<\/ul>\n<p><strong>K\u1ebft lu\u1eadn:<\/strong> N\u1ebfu v\u1eadn h\u00e0nh SMA 1000, h\u00e3y x\u00e1c nh\u1eadn m\u1eabu v\u00e0 b\u1ea3n d\u1ef1ng \u0111\u1ea7y \u0111\u1ee7 h\u00f4m nay, c\u00e0i hotfix m\u1edbi nh\u1ea5t, b\u1ea3o to\u00e0n b\u1eb1ng ch\u1ee9ng v\u00e0 r\u00e0 IoC. N\u1ebfu c\u00f3 d\u1ea5u v\u1ebft, m\u1edf r\u1ed9ng sang x\u00e2y d\u1ef1ng l\u1ea1i c\u00f9ng \u0111\u1eb7t l\u1ea1i m\u1eadt kh\u1ea9u v\u00e0 TOTP.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SonicWall x\u00e1c nh\u1eadn CVE-2026-15409 v\u00e0 CVE-2026-15410 tr\u00ean SMA 1000 \u0111ang b\u1ecb khai th\u00e1c. \u0110\u01a1n v\u1ecb b\u1ecb \u1ea3nh h\u01b0\u1edfng c\u1ea7n c\u00e0i hotfix m\u1edbi nh\u1ea5t, b\u1ea3o to\u00e0n b\u1eb1ng ch\u1ee9ng v\u00e0 ki\u1ec3m tra IoC; n\u1ebfu c\u00f3 d\u1ea5u v\u1ebft ph\u1ea3i tri\u1ec3n khai l\u1ea1i v\u00e0 \u0111\u1eb7t l\u1ea1i th\u00f4ng tin x\u00e1c th\u1ef1c.<\/p>\n","protected":false},"featured_media":0,"template":"","meta":[],"class_list":["post-591","briefing","type-briefing","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/briefing\/591","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/briefing"}],"about":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/types\/briefing"}],"wp:attachment":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/media?parent=591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}