---
id: "CVE-2026-112351"
kind: "vulnerability"
aliases: ["CVE-2026-112351"]
title: "Sunhillo SureLine: web account can run root commands via networkDiag.cgi"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "SureLine", "fixed": ["9.1.5"], "affected": "< 9.1.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "aviation-surveillance", "ics", "infrastructure", "network-appliance", "root-rce", "sunhillo-sureline"]
not_affected_if: ["version-9.1.5-or-later"]
published_at: "2026-10-27T20:17:12+00:00"
first_seen_at: "2026-10-27T20:33:27+00:00"
updated_at: "2026-10-27T20:36:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112351", "first_seen_at": "2026-10-27T20:33:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T20:36:29+00:00"}]
---

# Sunhillo SureLine: web account can run root commands via networkDiag.cgi

Sunhillo SureLine before 9.1.5 (per NVD, not vendor-confirmed) passes ipAddr and dnsAddr in networkDiag.cgi to a shell with an incomplete denylist; URL-encoded newline or ampersand bypasses it and commands run as root. Needs any web account. Affects Sunhillo gateways running SureLine (RICI, Longport, Ventnor, Margate, Brigantine SGP) that distribute radar/ADS-B data; exposure depends on who can reach the web GUI and who holds accounts. Teams without these appliances can skip it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SureLine affected < 9.1.5 fixed 9.1.5

## How to check

Check the SureLine software version in the web GUI (affected: before 9.1.5, per NVD summary via triage, unconfirmed by vendor). Check whether the web interface (/cgi/networkDiag.cgi) is reachable from untrusted networks, and review web accounts.

## Fix

- Upgrade Sunhillo SureLine to `9.1.5` or later.
- Until upgraded, restrict access to the SureLine web interface to trusted networks and review web accounts.

## Timeline

- 2026-10-27T20:33:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112351
- 2026-10-27T20:36:29+00:00 analyst — Could not retrieve NVD page (empty) nor find a Sunhillo advisory for 9.1.5; 9.1.5 fix and 'any web account' auth are unverified, from triage summary only. Same endpoint had unauth root injection CVE-2021-36380 (KEV, exploited, fixed 8.7.0.1.1; Sunhillo FB011) - linked as context, not evidence this CVE is exploited. Need Sunhillo field bulletin or NVD record to confirm fix and whether 9.1.5 is the only remediation.

## Documents

- [describes] Sunhillo SureLine product page https://www.sunhillo.com/product/sureline/
- [mentions] Sunhillo FB011 – SureLine vulnerability (CVE-2021-36380, same endpoint, earlier bug) https://www.sunhillo.com/fb011/

## From the sources

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_