CVE-2019-9160 is a critical backdoor vulnerability affecting Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier. A remote attacker can exploit this by logging into a hidden SSH service (port 22345) using a backdoor account, then escalating to root privileges due to a predictable root password derived from the WebUI admin password. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a severe risk with no user interaction required and complete compromise of confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the presence of a backdoor account poses a significant security risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.7.4.2CPE matchmatch criteria | cpe:2.3:o:xinruidz:sundray_wan_controller_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.