{"id":"CVE-2026-112352","kind":"vulnerability","aliases":["CVE-2026-112352"],"related":[],"title":"Sunhillo SureLine: forged cookie login bypass gives unauthenticated remote root","description":"Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.","summary":"Sunhillo SureLine before 9.1.5 trusts a session cookie that holds only a plain username, with no random token or signature. An unauthenticated attacker can guess a default account name such as Admin and forge that cookie to log in as that user.<br>The forged session chains into root command execution through the networkDiag.cgi component.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appliance","sunhillo","sureline","vendor","web-interface"],"not_affected_if":["version-9.1.5-or-later"],"how_to_check":"- Check the installed SureLine version and compare it against `9.1.5`.\n- Look for session cookies that contain a bare username with no random or signed value, if your access logs or proxy captures record them.\n- unknown for any other device-specific check; the sources do not say.","fix":"- Upgrade SureLine to `9.1.5` or later.\n- Until then, restrict access to the web interface to trusted networks.\n- Rotate passwords on default accounts such as Admin and sftp_user.","status":"open","published_at":"2026-10-27T20:17:12+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","triaged_at":"2026-10-27T20:35:25+00:00","updated_at":"2026-10-27T20:35:25+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-27T20:35:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SureLine to `9.1.5` or later.\n- Until then, restrict access to the web interface to trusted networks.\n- Rotate passwords on default accounts such as Admin and sftp_user.","reach":"unknown","title":"Sunhillo SureLine: forged cookie login bypass gives unauthenticated remote root","impact":"high","summary":"Sunhillo SureLine before 9.1.5 trusts a session cookie that holds only a plain username, with no random token or signature. An unauthenticated attacker can guess a default account name such as Admin and forge that cookie to log in as that user.<br>The forged session chains into root command execution through the networkDiag.cgi component.","category":"vendor","nicknames":[],"who_cares":["sunhillo","sureline","appliance","web-interface"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker gains root command execution on the appliance.","analyst_note":"Confirm the affected endpoint reach (internet or network) and any vendor advisory with a checkable version or config signal; the NVD entry is the only source.","how_to_check":"- Check the installed SureLine version and compare it against `9.1.5`.\n- Look for session cookies that contain a bare username with no random or signed value, if your access logs or proxy captures record them.\n- unknown for any other device-specific check; the sources do not say.","needs_analyst":true,"not_affected_if":["version-9.1.5-or-later"],"who_is_affected":"Any deployment of Sunhillo SureLine before 9.1.5 with its web interface reachable by an attacker is exposed. The sources do not describe which configurations are needed beyond the web session handling, so the exposure is likely broad for internet-facing or poorly segmented installs. Systems that run no SureLine version before 9.1.5 can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000674,"input_tokens":3389,"output_tokens":670,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112352':13A,16A '-2026':12A,15A '9.1.5':27B,81C 'account':51B,123C 'activ':99C 'admin':55B,127C 'allow':88C 'applianc':17B 'attack':46B,92C,119C 'authent':84C 'bypass':6A,85C 'chain':69B,147C 'check':141C 'checklogin':143C 'cleartext':110C 'command':72B,150C 'compon':77B 'contain':82C,107C 'cooki':4A,31B,59B,106C,136C 'cve':11A,14A 'default':50B,122C 'execut':73B,151C 'forg':3A,57B,67B,103C,134C 'give':7A 'guess':48B,121C 'hold':33B 'identifi':115C 'imperson':94C 'integr':117C 'interfac':23B 'libwebcmn.so':144C 'log':61B 'login':5A,140C 'name':52B,124C 'networkdiag.cgi':76B,146C 'plain':36B 'protect':118C 'random':40B,114C 'remot':9A,91C 'root':10A,71B,149C 'satisfi':138C 'session':30B,68B,101C,105C 'sftp':129C 'signatur':43B 'submit':132C 'sunhillo':1A,18B,24B,78C 'surelin':2A,19B,25B,79C 'token':41B 'trust':28B 'unauthent':8A,45B,90C 'user':65B,96C,130C 'usernam':37B,111C,135C 'vendor':20B 'vulner':86C 'web':22B,100C 'web-interfac':21B","nicknames":[],"mitigations":[],"who_affected":"Any deployment of Sunhillo SureLine before 9.1.5 with its web interface reachable by an attacker is exposed. The sources do not describe which configurations are needed beyond the web session handling, so the exposure is likely broad for internet-facing or poorly segmented installs. Systems that run no SureLine version before 9.1.5 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T20:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112352","severity":null,"published_at":"2026-10-27T20:17:12+00:00","modified_at":"2026-10-27T20:17:12+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","fetched_at":"2026-10-27T20:33:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}