PT-2019-19404 · Sangfor+1 · Sangfor Sundray Wlan Controller+1

Published 2019-04-18 · Updated 2020-08-24 · CVE-2019-9161

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sangfor Sundray WLAN Controller versions 3.7.4.2 and earlier

Description The issue allows remote attackers to achieve full access to the system. This is due to the fact that shell metacharacters in the nginx webconsole.php Cookie header can be used to read an etc/config/wac/wns cfg admin detail.xml file containing the admin password. The password for root is the WebUI admin password concatenated with a static string.

Recommendations For Sangfor Sundray WLAN Controller versions 3.7.4.2 and earlier, update to a version later than 3.7.4.2 to resolve the issue. As a temporary workaround, consider restricting access to the nginx webconsole.php endpoint to minimize the risk of exploitation. Avoid using the Cookie header in the affected endpoint until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-9161

Affected Products

Sangfor Sundray Wlan Controller

Nginx

References · 3

• https://osv.dev/vulnerability/CVE-2019-9161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9161 · Security Note
• http://cnvd.org.cn/flaw/show/CNVD-2019-07679 · Note