Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112351— Sunhillo SureLine OS Command Injection via networkDiag.cgi

Quick assessment

Affected
Sunhillo Corporation SureLine
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Sunhillo SureLine 9.1.5 之前的版本在网络诊断接口 networkDiag.cgi 中存在操作系统命令注入漏洞。任何拥有 Web 账户的已认证远程攻击者，均可通过向 ipAddr 或 dnsAddr 参数注入 Shell 元字符，以 root 权限执行任意命令。攻击者能够利用 URL 编码的换行符（%0a）或 ampersand 符号（%26）序列，绕过此前 CVE-2021-36380 修复中不完整的字符黑名单；这些序列在解码后会在 ping、nslookup 或 traceroute 诊断

CVSS 8.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Sunhillo Corporation SureLine 8.6.0< 9.1.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112351

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Sunhillo SureLine OS Command Injection via networkDiag.cgi
Source: CVE Program / CVE List V5
Vulnerability Description
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Sunhillo Corporation SureLine 8.6.0 ~ 9.1.5 -

II. Public POCs for CVE-2026-112351

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112351

请登录查看更多情报信息。

Other References for CVE-2026-112351 (2)

Same Patch Batch · Sunhillo Corporation · 2026-10-27 · 3 CVEs total

CVE-2026-112352 9.1 CRITICAL Sunhillo SureLine Authentication Bypass via Session Cookie
CVE-2026-112350 7.5 HIGH Sunhillo SureLine Path Traversal via radarUpdater.cgi

IV. Related Vulnerabilities

Same product: SureLine
Same vendor: Sunhillo Corporation
Same weakness: CWE-78