CVE-2026-112352: Sunhillo SureLine Authentication Bypass via Session Cookie
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftpuser and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Sunhillo SureLine deployments running versions before 9.1.5 are affected. The issue is reachable remotely through the web-facing authentication flow.
What does an attacker need to exploit this issue?
An attacker does not need valid credentials, prior access, or user interaction. They can forge a session cookie containing a cleartext username, potentially using guessable account names such as Admin or sftp_user.
What level of access can exploitation provide?
A successful attacker can impersonate any user with an active web session. The issue can be chained into root command execution.