CVE-2019-9161: Xinruidz Sundray WAN Controller Firmware

Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days.

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginx_webconsole.php Cookie header can be used to read an etc/config/wac/wns_cfg_admin_detail.xml file containing the admin password. (The password for root is the WebUI admin password concatenated with a static string.)

Affected products

• Xinruidz Sundray WAN Controller Firmware: up to and including 3.7.4.2

Published 2019-04-18. Last modified 2026-06-17.