CVE-2026-112351

Sunhillo SureLine OS Command Injection via networkDiag.cgi

Sunhillo Corporation SureLine

Open in Threatline Record JSON

CVSS

8.7High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in9.1.5Fixed versionCVE List

Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

9.1.5SureLineCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-112351 Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to exeTelegram: CVE Notify, 27 Oct 2026

Description

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.

Text from CVE List

Affected versions 1

SureLineaffected: 8.6.0 before 9.1.5CVE List