EUVD-2019-18539

Malware in sbrugna...

File Upload Vulnerability in WAC Wireless Controller Software

Sundray WAC is a set of WirelessAccessControl software from Shenzhen Sundray Technology Co. The WAC wireless controller software has a file upload vulnerability that can be exploited by an attacker to upload malicious files to gain server control privileges...

DeepSync Sundray WLAN Controller Trust Management Issue Vulnerability

Sundray WLAN Controller Sundray WAC is a set of wireless LAN controller software from China Sundray Network Technology Sundray. Sundray WAC 3.7.4.2 and earlier versions contain an encryption issue vulnerability, which originates from a network system or product that does not correctly use the...

DeepSync Sundray WLAN Controller Command Injection Vulnerability

Sundray WLAN Controller Sundray WAC is a set of wireless LAN controller software from China Sundray Network Technology Sundray. A security vulnerability exists in Sundray WAC 3.7.4.2 and previous versions of WAC. The vulnerability can be exploited by a remote attacker to read the...

Remote code execution

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginxwebconsole.php Cookie header can be used to read an etc/config/wac/wnscfgadmindetail.xm...

CVE-2019-9161

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginxwebconsole.php Cookie header can be used to read an etc/config/wac/wnscfgadmindetail.xm...

CVE-2019-9161

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginxwebconsole.php Cookie header can be used to read an etc/config/wac/wnscfgadmindetail.xm...

CVE-2019-9160

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH on TCP port 22345 and escalate to root because the password for root is the WebUI admin password concatenated with a static string...

CVE-2019-9160

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH on TCP port 22345 and escalate to root because the password for root is the WebUI admin password concatenated with a static string...

Design/Logic Flaw

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH on TCP port 22345 and escalate to root because the password for root is the WebUI admin password concatenated with a static string...

CVE-2019-9161

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginxwebconsole.php Cookie header can be used to read an etc/config/wac/wnscfgadmindetail.xm...

CVE-2019-9161

CVE-2019-9161 affects Sangfor Sundray WLAN Controller (WAC) versions 3.7.4.2 and earlier. The issue is a remote code execution vulnerability where shell metacharacters in the nginx_webconsole.php Cookie header allow an attacker to read /etc/config/wac/wns_cfg_admin_detail.xml, exposing the admin ...

CVE-2019-9160

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH on TCP port 22345 and escalate to root because the password for root is the WebUI admin password concatenated with a static string...

CVE-2019-9160

The CVE-2019-9160 issue affects Sangfor Sundray/WAC, specifically version 3.7.4.2 and earlier. It enables a backdoor SSH login on TCP 22345, allowing remote access beyond the WebUI and enabling root escalation because the root password is the WebUI admin password concatenated with a static string...