Live › vulnerability › CVE-2026-112352
Go to dashboardSunhillo SureLine before 9.1.5 trusts a session cookie that holds only a plain username, with no random token or signature. An unauthenticated attacker can guess a default account name such as Admin and forge that cookie to log in as that user.<br>The forged session chains into root command execution through the networkDiag.cgi component.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 20:33 UTC. All times on this page are UTC.
Any deployment of Sunhillo SureLine before 9.1.5 with its web interface reachable by an attacker is exposed. The sources do not describe which configurations are needed beyond the web session handling, so the exposure is likely broad for internet-facing or poorly segmented installs. Systems that run no SureLine version before 9.1.5 can skip it.
No product ranges from the sources yet.
9.1.5.9.1.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-112352")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.