CVE-2026-112351: Sunhillo SureLine OS Command Injection via networkDiag.cgi
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sunhillo SureLineto a version that resolves this vulnerability.Fixed in 9.1.5
Event History
Frequently Asked Questions
Which deployments are affected?
Sunhillo SureLine versions before 9.1.5 are affected. The vulnerable functionality is the networkDiag.cgi endpoint.
What access does an attacker need to exploit this issue?
An attacker must be able to reach the web interface remotely and authenticate with any web account. No user interaction is required, and the attack complexity is low.
What is the potential impact of successful exploitation?
An attacker can inject commands through the ipAddr or dnsAddr parameters in ping, nslookup, or traceroute diagnostic modes. The injected commands execute as root, allowing full system compromise affecting confidentiality, integrity, and availability.
How can the prior input filtering be bypassed?
URL-encoded newline (%0a) or ampersand (%26) sequences can act as command separators after decoding. These sequences bypass the incomplete character denylist used by the earlier fix.