Read the docs
TI-2026-81518 Aliases CVE-2026-112350GHSA-q7gg-whqr-w8f9

Path traversal in Sunhillo SureLine lets attackers read arbitrary files

Priority MEDIUM 45CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Sunhillo SureLine from 8.0.0 before 9.1.5 contains a path traversal flaw (CWE-22) in the radarUpdater.cgi endpoint. Missing authentication checks and insufficient sanitization of the filename parameter let an unauthenticated remote attacker read arbitrary files with root privileges. Such files include /etc/shadow, the web user database, the root SSH private key and the device's TLS private key, which can lead to full system compromise.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00949 61st percentileScored 2026-11-07
Fix Fixed SureLine (Sunhillo Corporation): 9.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SunhilloSureLine8.0.0 to before 9.1.59.1.5Patch availableCNA
  • SureLine VendorSunhillo Affected 8.0.0 to before 9.1.5 Fixed in 9.1.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sunhillo:sureline:*:*:*:*:*:*:*:*8.0.0 to before 9.1.5VulnerableSunhillo
  • cpe:2.3:a:sunhillo:sureline:*:*:*:*:*:*:*:* Versions 8.0.0 to before 9.1.5 Vulnerable ·Sunhillo

Remediation

Update Sunhillo SureLine to version 9.1.5, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA SureLine (Sunhillo Corporation) Fixed in 9.1.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sunhillo SureLine 9.1.5

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-81519 OS command injection in Sunhillo SureLine via networkDiag.cgiPriority MEDIUM 45
    • TI-2026-81524 Authentication bypass in Sunhillo SureLine via forged session cookiePriority MEDIUM 44
    Show all 3 records →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-112350
  2. 2026-10-27 Alias added: GHSA-q7gg-whqr-w8f9
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-02 CISA SSVC decision points changed
  5. 2026-11-02 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2021-14731 Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-81519 OS command injection in Sunhillo SureLine via networkDiag.cgi CVSS 4.0HIGH 8.7
  • TI-2026-81524 Authentication bypass in Sunhillo SureLine via forged session cookie CVSS 4.0CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences