RCE in SonicWall Global Management System XML-RPC set_time_config

Successful exploitation allows remote arbitrary code execution on the SonicWall GMS virtual appliance. This can lead to full compromise of the management system, including execution of attacker-controlled commands, installation of malware or botnet payloads, persistence, and use of the appliance as a foothold for further activity. Reporting cited active exploitation by Gafgyt/Rabbot-related malware to deploy malicious payloads.

If immediate patching or upgrade is not possible, restrict network access to the GMS XML-RPC interface to trusted administrative hosts only, remove unnecessary Internet exposure, and place the management interface behind VPN or ACL controls. Monitor for suspicious XML-RPC requests, especially to the set_time_config method, and inspect for signs of post-exploitation such as unexpected processes, configuration changes, or malware deployment. Given observed botnet exploitation, exposed unsupported instances should be treated as high risk.

Upgrade SonicWall Global Management System to a fixed, supported release that addresses CVE-2018-9866. Because the vulnerability affects GMS 8.1 and earlier and reporting explicitly notes these were older, unsupported versions, organizations should migrate off unsupported releases and apply SonicWall vendor guidance and patches from the relevant advisory.