Live › vulnerability › CVE-2026-112351
Go to dashboardSunhillo SureLine before 9.1.5 (per NVD, not vendor-confirmed) passes ipAddr and dnsAddr in networkDiag.cgi to a shell with an incomplete denylist; URL-encoded newline or ampersand bypasses it and commands run as root. Needs any web account. Affects Sunhillo gateways running SureLine (RICI, Longport, Ventnor, Margate, Brigantine SGP) that distribute radar/ADS-B data; exposure depends on who can reach the web GUI and who holds accounts. Teams without these appliances can skip it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 20:33 UTC. All times on this page are UTC.
Any deployment of Sunhillo SureLine older than 9.1.5 that exposes the web interface is in scope, since any authenticated web account can reach networkDiag.cgi. Sources do not say whether the endpoint is reachable from the internet in default installs. Teams not running SureLine can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SureLine | vendor | < 9.1.5 | 9.1.5 |
9.1.5, per NVD summary via triage, unconfirmed by vendor)9.1.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.
This page as .md · .json · in your agent: get_signal("CVE-2026-112351")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.