Read the docs
TI-2026-81519 Aliases CVE-2026-112351GHSA-x64r-r4gj-xh6q

OS command injection in Sunhillo SureLine via networkDiag.cgi

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Sunhillo SureLine from 8.6.0 before 9.1.5 contains an OS command injection flaw (CWE-78) in the networkDiag.cgi endpoint. An authenticated remote attacker with any web account can inject shell metacharacters into the ipAddr or dnsAddr parameters, because the existing character denylist is incomplete and URL-encoded newline and ampersand sequences act as command separators after decoding. Successful exploitation executes arbitrary commands as root.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02683 85th percentileScored 2026-11-07
Fix Fixed SureLine (Sunhillo Corporation): 9.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SunhilloSureLine8.6.0 to before 9.1.59.1.5Patch availableCNA
  • SureLine VendorSunhillo Affected 8.6.0 to before 9.1.5 Fixed in 9.1.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sunhillo:sureline:*:*:*:*:*:*:*:*8.6.0 to before 9.1.5VulnerableSunhillo
  • cpe:2.3:a:sunhillo:sureline:*:*:*:*:*:*:*:* Versions 8.6.0 to before 9.1.5 Vulnerable ·Sunhillo

Remediation

Upgrade Sunhillo SureLine to version 9.1.5 or later, which contains the fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA SureLine (Sunhillo Corporation) Fixed in 9.1.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sunhillo SureLine 9.1.5

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-81518 Path traversal in Sunhillo SureLine lets attackers read arbitrary filesPriority MEDIUM 45
    • TI-2026-81524 Authentication bypass in Sunhillo SureLine via forged session cookiePriority MEDIUM 44
    Show all 3 records →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-112351
  2. 2026-10-27 Alias added: GHSA-x64r-r4gj-xh6q
  3. 2026-11-03 CISA SSVC decision points changed

References

Other 1

  • TI-2021-14731 Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-81518 Path traversal in Sunhillo SureLine lets attackers read arbitrary files CVSS 4.0HIGH 8.7
  • TI-2026-81524 Authentication bypass in Sunhillo SureLine via forged session cookie CVSS 4.0CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences