1. Home
  2. CVE Database
  3. CVE-2019-9160
CRITICAL · 9.8

CVE-2019-9160

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH (on TCP port 22345) and escalate to root (becaus...

Vulnerability Description

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH (on TCP port 22345) and escalate to root (because the password for root is the WebUI admin password concatenated with a static string).

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
XinruidzSundray Wan Controller Firmware<= 3.7.4.2
XinruidzSundray Wan Controller-

Related Weaknesses (CWE)

CWE-798

References

FAQ

What is CVE-2019-9160?

CVE-2019-9160 is a vulnerability with a CVSS score of 9.8 (CRITICAL). WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH (on TCP port 22345) and escalate to root (becaus...

How severe is CVE-2019-9160?

CVE-2019-9160 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-9160?

Check the references section above for vendor advisories and patch information. Affected products include: Xinruidz Sundray Wan Controller Firmware, Xinruidz Sundray Wan Controller.