CVE-2026-112351
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the…
- Risk score
- 53/100
- CVSS
- 8.8 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incompl…
- Affected
- See advisory
- Fix
- Upgrade the product to 9.1.5 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
Original description
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.
Last activity 27 Oct 2026. Patch Forecast updates every hour.