---
id: "CVE-2026-112350"
kind: "vulnerability"
aliases: ["CVE-2026-112350"]
title: "Sunhillo SureLine: unauthenticated path traversal reads root-owned files"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["appliance", "infrastructure", "network-monitoring", "sunhillo", "sureline"]
not_affected_if: ["patched-to-9.1.5"]
published_at: "2026-10-27T20:17:12+00:00"
first_seen_at: "2026-10-27T20:33:27+00:00"
updated_at: "2026-10-27T20:35:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112350", "first_seen_at": "2026-10-27T20:33:27+00:00"}]
---

# Sunhillo SureLine: unauthenticated path traversal reads root-owned files

Sunhillo SureLine before 9.1.5 has a path traversal flaw in the radarUpdater.cgi endpoint. An unauthenticated remote attacker can read arbitrary files as root, including /etc/shadow, the web user database, the root SSH private key and the TLS private key.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SureLine version against `9.1.5` in the admin interface or product documentation
- Check whether radarUpdater.cgi is reachable from untrusted networks (unknown how to test beyond this)

## Fix

- Upgrade SureLine to `9.1.5` or later
- After upgrading, rotate the root SSH key, the TLS private key and web user credentials if the device was exposed before patching (the sources say the files are readable, not that they were read)

## Timeline

- 2026-10-27T20:33:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112350

## From the sources

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_