CVE-2026-112351

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

CVE-2026-112352

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-112350

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...

CVE-2026-112352 Sunhillo SureLine Authentication Bypass via Session Cookie

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

EUVD-2026-111360

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-112352

Sunhillo SureLine versions prior to 9.1.5 are vulnerable to an authentication bypass due to a lack of validation and integrity protection on session cookies. An unauthenticated remote attacker can impersonate any user with an active session by forging a cookie containing a cleartext username, suc...

CVE-2026-112352 Sunhillo SureLine Authentication Bypass via Session Cookie

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

EUVD-2026-111359

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

CVE-2026-112351 Sunhillo SureLine OS Command Injection via networkDiag.cgi

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

CVE-2026-112351

Sunhillo SureLine versions prior to 9.1.5 are vulnerable to an OS command injection vulnerability in the networkDiag.cgi endpoint. An authenticated remote attacker with any web account can execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. ...

CVE-2026-112351 Sunhillo SureLine OS Command Injection via networkDiag.cgi

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

CVE-2026-112350 Sunhillo SureLine Path Traversal via radarUpdater.cgi

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...

CVE-2026-112350

Sunhillo SureLine versions prior to 9.1.5 are vulnerable to a path traversal flaw in the radarUpdater.cgi endpoint. The root cause is a lack of authentication checks and insufficient sanitization of the filename parameter, allowing unauthenticated remote attackers to read arbitrary files with roo...

CVE-2026-112350 Sunhillo SureLine Path Traversal via radarUpdater.cgi

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...

EUVD-2026-111361

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...

Sunhillo SureLine session mechanism vulnerability

Versions prior to Sunhillo SureLine 9.1.5 contain a vulnerability related to the session mechanism. This vulnerability stems from authentication bypass; unauthenticated remote attackers can forge session cookies containing only plaintext usernames, lacking random identifiers or integrity checks. ...

CVE-2026-112352: Reliance on Cookies without Validation and Integrity Checking

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-112350: Improper Limitation of a Pathname to a Restricted Directory

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...

PT-2026-127217

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

Sunhillo SureLine command injection vulnerability

Versions prior to Sunhillo SureLine 9.1.5 contain a command injection vulnerability. This vulnerability stems from OS command injection in the networkDiag.cgi endpoint. Authenticated remote attackers can inject shell metacharacters into the ipAddr or dnsAddr parameters, thereby bypassing characte...