CVE-2026-15409 is an unauthenticated Server-Side Request Forgery vulnerability affecting the SMA1000 WorkPlace interface. Attackers can exploit the /wsproxy WebSocket endpoint to access a locally bound Erlang distribution node. This node, identified as couchdb, runs on 127.0.0.1:1050. The Erlang handshake is completed using a hardcoded cookie. Subsequently, the os:cmd() function allows for remote command execution with the privileges of the couchdb user. From this point, attackers can read the policy_file.xml to obtain decrypted LDAP bind passwords. This decryption is made possible by a static 32-byte AES key found within the ASAPPasswordUtil.class bytecode. Attackers then deploy a Linux build of Impacket's secretsdump tool to the appliance's /tmp directory. Using the recovered LDAP credentials and domain-controller machine account hashes, secretsdump performs DCSync against internal domain controllers. The exploit chain is a refactored version of a public proof-of-concept aimed at unattended bulk exploitation.