{"id":"CVE-2026-112350","kind":"vulnerability","aliases":["CVE-2026-112350"],"related":[],"title":"Sunhillo SureLine: unauthenticated path traversal reads root-owned files","description":"Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.","summary":"Sunhillo SureLine before 9.1.5 has a path traversal flaw in the radarUpdater.cgi endpoint. An unauthenticated remote attacker can read arbitrary files as root, including /etc/shadow, the web user database, the root SSH private key and the TLS private key.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appliance","infrastructure","network-monitoring","sunhillo","sureline"],"not_affected_if":["patched-to-9.1.5"],"how_to_check":"- Check the installed SureLine version against `9.1.5` in the admin interface or product documentation\n- Check whether radarUpdater.cgi is reachable from untrusted networks (unknown how to test beyond this)","fix":"- Upgrade SureLine to `9.1.5` or later\n- After upgrading, rotate the root SSH key, the TLS private key and web user credentials if the device was exposed before patching (the sources say the files are readable, not that they were read)","status":"open","published_at":"2026-10-27T20:17:12+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","triaged_at":"2026-10-27T20:35:26+00:00","updated_at":"2026-10-27T20:35:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T20:35:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SureLine to `9.1.5` or later\n- After upgrading, rotate the root SSH key, the TLS private key and web user credentials if the device was exposed before patching (the sources say the files are readable, not that they were read)","reach":"network","title":"Sunhillo SureLine: unauthenticated path traversal reads root-owned files","impact":"high","summary":"Sunhillo SureLine before 9.1.5 has a path traversal flaw in the radarUpdater.cgi endpoint. An unauthenticated remote attacker can read arbitrary files as root, including /etc/shadow, the web user database, the root SSH private key and the TLS private key.","category":"infrastructure","nicknames":[],"who_cares":["sunhillo","sureline","appliance","network-monitoring"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads root SSH key and shadow file, full system compromise","analyst_note":"Confirm endpoint exposure and any exploitation evidence at https://nvd.nist.gov/vuln/detail/CVE-2026-112350; sources give no vendor advisory or detection method.","how_to_check":"- Check the installed SureLine version against `9.1.5` in the admin interface or product documentation\n- Check whether radarUpdater.cgi is reachable from untrusted networks (unknown how to test beyond this)","needs_analyst":true,"not_affected_if":["patched-to-9.1.5"],"who_is_affected":"Any SureLine deployment before 9.1.5 where the radarUpdater.cgi endpoint is reachable is exposed, since the flaw needs no login. The sources do not say which network placements or configurations are most at risk, so treat any internet-reachable or broadly internal instance as exposed. Installations already on 9.1.5 or later are not affected by this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000675,"input_tokens":3391,"output_tokens":671,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112350':13A,16A '-2026':12A,15A '/etc/shadow':48B,112C '9.1.5':27B,66C 'access':107C 'allow':77C 'applianc':17B 'arbitrari':43B,83C 'attack':40B,80C,100C 'authent':91C 'check':92C 'compromis':133C 'contain':67C 'cve':11A,14A 'databas':52B,116C 'devic':124C 'directori':103C 'due':88C 'endpoint':36B,75C 'file':10A,44B,84C,109C 'filenam':98C 'flaw':32B 'full':131C 'includ':47B 'infrastructur':18B 'insuffici':94C 'key':57B,62B,121C,128C 'lead':129C 'miss':90C 'monitor':21B 'network':20B 'network-monitor':19B 'own':9A 'paramet':99C 'path':4A,30B,69C 'privat':56B,61B,120C,127C 'privileg':87C 'radarupdater.cgi':35B,74C 'read':6A,42B,82C 'remot':39B,79C 'root':8A,46B,54B,86C,118C 'root-own':7A 'sanit':95C 'sensit':108C 'sequenc':105C 'ssh':55B,119C 'sunhillo':1A,22B,24B,63C 'surelin':2A,23B,25B,64C 'system':132C 'tls':60B,126C 'travers':5A,31B,70C,104C 'unauthent':3A,38B,78C 'use':102C 'user':51B,115C 'vulner':71C 'web':50B,114C","nicknames":[],"mitigations":[],"who_affected":"Any SureLine deployment before 9.1.5 where the radarUpdater.cgi endpoint is reachable is exposed, since the flaw needs no login. The sources do not say which network placements or configurations are most at risk, so treat any internet-reachable or broadly internal instance as exposed. Installations already on 9.1.5 or later are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T20:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112350","severity":null,"published_at":"2026-10-27T20:17:12+00:00","modified_at":"2026-10-27T20:17:12+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","fetched_at":"2026-10-27T20:33:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}