{"id":"CVE-2026-112351","kind":"vulnerability","aliases":["CVE-2026-112351"],"related":[],"title":"Sunhillo SureLine: web account can run root commands via networkDiag.cgi","description":"Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.","summary":"Sunhillo SureLine before 9.1.5 (per NVD, not vendor-confirmed) passes ipAddr and dnsAddr in networkDiag.cgi to a shell with an incomplete denylist; URL-encoded newline or ampersand bypasses it and commands run as root. Needs any web account. Affects Sunhillo gateways running SureLine (RICI, Longport, Ventnor, Margate, Brigantine SGP) that distribute radar/ADS-B data; exposure depends on who can reach the web GUI and who holds accounts. Teams without these appliances can skip it.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SureLine","fixed":["9.1.5"],"affected":"< 9.1.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","aviation-surveillance","ics","infrastructure","network-appliance","root-rce","sunhillo-sureline"],"not_affected_if":["version-9.1.5-or-later"],"how_to_check":"Check the SureLine software version in the web GUI (affected: before 9.1.5, per NVD summary via triage, unconfirmed by vendor). Check whether the web interface (/cgi/networkDiag.cgi) is reachable from untrusted networks, and review web accounts.","fix":"- Upgrade Sunhillo SureLine to `9.1.5` or later.\n- Until upgraded, restrict access to the SureLine web interface to trusted networks and review web accounts.","status":"open","published_at":"2026-10-27T20:17:12+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","triaged_at":"2026-10-27T20:35:25+00:00","updated_at":"2026-10-27T20:36:29+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-27T20:35:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Sunhillo SureLine to `9.1.5` or later.\n- Until upgraded, restrict access to the SureLine web interface to trusted networks and review web accounts.","reach":"unknown","title":"Sunhillo SureLine: web account can run root commands via networkDiag.cgi","impact":"high","summary":"Sunhillo SureLine before 9.1.5 passes the ipAddr and dnsAddr parameters of its networkDiag.cgi endpoint to a shell without proper filtering. An attacker with any web account can inject commands, using URL-encoded newline or ampersand characters to bypass the incomplete denylist, and runs them as root.","category":"infrastructure","nicknames":[],"who_cares":["sunhillo-sureline","network-appliance"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as root on the appliance.","analyst_note":"Confirm the reach of the web interface in default installs and whether the 9.1.5 fix is the only remediation, via the NVD entry and vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-9.1.5-or-later"],"who_is_affected":"Any deployment of Sunhillo SureLine older than 9.1.5 that exposes the web interface is in scope, since any authenticated web account can reach networkDiag.cgi. Sources do not say whether the endpoint is reachable from the internet in default installs. Teams not running SureLine can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000627,"input_tokens":3432,"output_tokens":567,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the reach of the web interface in default installs and whether the 9.1.5 fix is the only remediation, via the NVD entry and vendor advisory.","search":"'-112351':13A,16A '-2021':158C '-2026':12A,15A '-36380':159C '0a':166C '26':169C '9.1.5':36B,110C 'account':4A,72B,100B,130C 'act':172C 'affect':73B 'allow':122C 'ampersand':61B,168C 'applianc':26B,104B 'arbitrari':133C 'attack':126C,147C 'authent':18B,124C 'aviat':20B 'aviation-surveil':19B 'brigantin':82B 'bypass':62B,149C 'charact':152C 'command':8A,65B,114C,134C,174C 'compromis':190C 'confirm':42B 'contain':111C 'cve':11A,14A,157C 'data':87B 'decod':177C 'denylist':55B,153C 'depend':89B 'diagnost':184C 'distribut':85B 'dnsaddr':46B,145C 'encod':58B,164C 'endpoint':120C 'execut':132C 'exposur':88B 'fix':160C 'full':188C 'gateway':75B 'gui':96B 'hold':99B 'ic':22B 'incomplet':54B,151C 'infrastructur':23B 'inject':115C,138C 'ipaddr':44B,143C 'lead':186C 'longport':79B 'margat':81B 'metacharact':140C 'mode':185C 'need':69B 'network':25B 'network-appli':24B 'networkdiag.cgi':10A,48B,119C 'newlin':59B,165C 'nslookup':181C 'nvd':38B 'os':113C 'paramet':146C 'pass':43B 'per':37B 'ping':180C 'prior':156C 'radar/ads-b':86B 'rce':29B 'reach':93B 'remot':125C 'rici':78B 'root':7A,28B,68B,136C 'root-rc':27B 'run':6A,66B,76B 'separ':175C 'sequenc':170C 'sgp':83B 'shell':51B,139C 'skip':106B 'sunhillo':1A,31B,33B,74B,107C 'sunhillo-surelin':30B 'surelin':2A,32B,34B,77B,108C 'sureline':17A 'surveil':21B 'system':189C 'team':101B 'tracerout':183C 'url':57B,163C 'url-encod':56B,162C 'use':161C 'vendor':41B 'vendor-confirm':40B 'ventnor':80B 'via':9A 'vulner':116C 'web':3A,71B,95B,129C 'without':102B","nicknames":[],"mitigations":[],"who_affected":"Any deployment of Sunhillo SureLine older than 9.1.5 that exposes the web interface is in scope, since any authenticated web account can reach networkDiag.cgi. Sources do not say whether the endpoint is reachable from the internet in default installs. Teams not running SureLine can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T20:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112351","severity":null,"published_at":"2026-10-27T20:17:12+00:00","modified_at":"2026-10-27T20:17:12+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","fetched_at":"2026-10-27T20:33:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112351:922","url":null,"severity":null,"published_at":"2026-10-27T20:36:29+00:00","modified_at":"2026-10-27T20:36:29+00:00","first_seen_at":"2026-10-27T20:36:29+00:00","fetched_at":"2026-10-27T20:36:29+00:00","note":"Could not retrieve NVD page (empty) nor find a Sunhillo advisory for 9.1.5; 9.1.5 fix and 'any web account' auth are unverified, from triage summary only. Same endpoint had unauth root injection CVE-2021-36380 (KEV, exploited, fixed 8.7.0.1.1; Sunhillo FB011) - linked as context, not evidence this CVE is exploited. Need Sunhillo field bulletin or NVD record to confirm fix and whether 9.1.5 is the only remediation."}],"documents":[{"id":7762,"url":"https://www.sunhillo.com/fb011/","title":"Sunhillo FB011 – SureLine vulnerability (CVE-2021-36380, same endpoint, earlier bug)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":7763,"url":"https://www.sunhillo.com/product/sureline/","title":"Sunhillo SureLine product page","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}