Xinruidz Sundray Wan Controller Firmware vulnerabilities
2 known vulnerabilities affecting xinruidz/sundray_wan_controller_firmware.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2
Vulnerabilities
Page 1 of 1
CVE-2019-9160P2CRITICALCVSS 9.8≤ 3.7.4.22019-04-18
CVE-2019-9160 [CRITICAL] CWE-798 CVE-2019-9160: WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowi
WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH (on TCP port 22345) and escalate to root (because the password for root is the WebUI admin password concatenated with a static string).
nvd
CVE-2019-9161P2CRITICALCVSS 9.8≤ 3.7.4.22019-04-18
CVE-2019-9161 [CRITICAL] CWE-78 CVE-2019-9161: WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution i
WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginx_webconsole.php Cookie header can be used to read an etc/config/wac/wns_cfg_admin_detail.xml file containing the admin password. (The password
nvd