Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec
Defensive Security Podcast Episode 355
Aug 8, 2026 · 1 hr 8 min · 11 segments
Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec
Aug 8, 2026 · 1 hr 8 min · 11 segments
Jerry BellHost
Andrew KellettHost
It is a day that ends in Y, which means that there is a new SMA 1000 vulnerability for you to go fix.
So in this instance, by the way, we're finding that this was actually being exploited during a period that it was not previously known.
So- Uh, was being exploited all the way back in June, and the patches were just recently released.
There's a, there's a fairly convoluted chain of vulnerabilities that an actor was, was taking to get, get in.
I, I don't think you can, you can mitigate this one by removing the admin interface from the internet, so that's the unfortunate part.
I mean, if it, if by removing the admin interface, you also remove the SonicWall device completely as a secondary impact.
Well, so, so that's where I was struggling with the ridiculous statement, and I was gonna say it, but, you know, putting your firewall behind a firewall is really kind of where we're at.
There's a few one, I, I'm sure you're gonna cover it, but I have some notes in here that just made me shake my head.
Again, I get it, like bad guys are gonna bad guy, and they're gonna find vulnerabilities.
But there's a few things in this one, at least one big one that SonicWall did that did not help themselves at all, and somebody should be poked with a big clue by four.
So, so this one, this one used an SSRF vulnerability and that, that allowed access to a CouchDB install- a CouchDB instance on the appliance that had a hard-coded username and password of admin, admin, which then allowed the adversary to, uh, basically install an implant on the appliance, which they then used to, um, you know, to put a web shell in and do all the things, right? So, so that's...
I, I, I don't know if that's where, where you were, where you were going, but I, I, I kinda, I go back to one of the fundamental issues we've had with these security appliances is they've had kind of free reign for so long.
You know, it's, it's kinda like been a black box that no one's really paid attention to, and we're finally starting to, to, you know, see what happens when sunlight shines on them, and holy moly, are the bugs running out.
The thing that's frustrating, and, and you did touch on this, and they, they talk about this quoting from the article, "The bundled CouchDB ships with hard-coded admin, admin credentials, and it is normally localhost only, but the SSRF tunnel put it within reach." So what I'm gonna say is probably pretty obvious, but you, you shouldn't assume something can't be touched, right? You shouldn't have this, "Well, it's internal only, uh, so we can just use default credentials." You have to assume that something small could lead to that, and, and these attacks can be chained.
It is a day that ends in Y, which means that there is a new SMA 1000 vulnerability for you to go fix.
So in this instance, by the way, we're finding that this was actually being exploited during a period that it was not previously known.
So- Uh, was being exploited all the way back in June, and the patches were just recently released.
There's a, there's a fairly convoluted chain of vulnerabilities that an actor was, was taking to get, get in.
I, I don't think you can, you can mitigate this one by removing the admin interface from the internet, so that's the unfortunate part.
I mean, if it, if by removing the admin interface, you also remove the SonicWall device completely as a secondary impact.
Well, so, so that's where I was struggling with the ridiculous statement, and I was gonna say it, but, you know, putting your firewall behind a firewall is really kind of where we're at.
There's a few one, I, I'm sure you're gonna cover it, but I have some notes in here that just made me shake my head.
Again, I get it, like bad guys are gonna bad guy, and they're gonna find vulnerabilities.
But there's a few things in this one, at least one big one that SonicWall did that did not help themselves at all, and somebody should be poked with a big clue by four.
So, so this one, this one used an SSRF vulnerability and that, that allowed access to a CouchDB install- a CouchDB instance on the appliance that had a hard-coded username and password of admin, admin, which then allowed the adversary to, uh, basically install an implant on the appliance, which they then used to, um, you know, to put a web shell in and do all the things, right? So, so that's...
I, I, I don't know if that's where, where you were, where you were going, but I, I, I kinda, I go back to one of the fundamental issues we've had with these security appliances is they've had kind of free reign for so long.
You know, it's, it's kinda like been a black box that no one's really paid attention to, and we're finally starting to, to, you know, see what happens when sunlight shines on them, and holy moly, are the bugs running out.
The thing that's frustrating, and, and you did touch on this, and they, they talk about this quoting from the article, "The bundled CouchDB ships with hard-coded admin, admin credentials, and it is normally localhost only, but the SSRF tunnel put it within reach." So what I'm gonna say is probably pretty obvious, but you, you shouldn't assume something can't be touched, right? You shouldn't have this, "Well, it's internal only, uh, so we can just use default credentials." You have to assume that something small could lead to that, and, and these attacks can be chained.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.