---
id: "CVE-2026-112352"
kind: "vulnerability"
aliases: ["CVE-2026-112352"]
title: "Sunhillo SureLine: forged cookie login bypass gives unauthenticated remote root"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["appliance", "sunhillo", "sureline", "vendor", "web-interface"]
not_affected_if: ["version-9.1.5-or-later"]
published_at: "2026-10-27T20:17:12+00:00"
first_seen_at: "2026-10-27T20:33:27+00:00"
updated_at: "2026-10-27T20:35:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112352", "first_seen_at": "2026-10-27T20:33:27+00:00"}]
---

# Sunhillo SureLine: forged cookie login bypass gives unauthenticated remote root

Sunhillo SureLine before 9.1.5 trusts a session cookie that holds only a plain username, with no random token or signature. An unauthenticated attacker can guess a default account name such as Admin and forge that cookie to log in as that user.<br>The forged session chains into root command execution through the networkDiag.cgi component.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SureLine version and compare it against `9.1.5`.
- Look for session cookies that contain a bare username with no random or signed value, if your access logs or proxy captures record them.
- unknown for any other device-specific check; the sources do not say.

## Fix

- Upgrade SureLine to `9.1.5` or later.
- Until then, restrict access to the web interface to trusted networks.
- Rotate passwords on default accounts such as Admin and sftp_user.

## Timeline

- 2026-10-27T20:33:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112352

## From the sources

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_