Sunhillo SureLine: Path traversal in radarUpdater.cgi
Summary
Sunhillo SureLine before 9.1.5 contains a path traversal flaw in the radarUpdater.cgi endpoint. An unauthenticated remote attacker can read arbitrary files with root privileges by using directory traversal sequences in the filename parameter. Sensitive files such as /etc/shadow, the web user database, the root SSH private key and the TLS private key can be read, which may lead to full system compromise.
Affected
- Sunhillo SureLine 8.0.0 to before 9.1.5
- VulDB describes the issue as affecting up to 9.1.4
- Unknown: whether 8.x branches receive a fix
Fixed in
- Upgrade to SureLine 9.1.5 or later (per VulDB and the CVE record)
Workaround
- Unknown. No vendor workaround found.
- Interim measure: restrict access to the SureLine web interface to a management VLAN or VPN and block internet access at the firewall.
Exploitation
- No evidence of exploitation in the wild found at the time of writing.
- Not listed in CISA KEV.
- No public proof of concept found.
- The CVE was published only recently, so the situation may change quickly.
Our recommendation
- Inventory all SureLine instances and their versions.
- Check whether any instance is reachable from the internet.
- Check the vendor advisory directly with Sunhillo, then upgrade to 9.1.5.
- Restrict access to the web interface until the upgrade is done.
- If an exposed instance was unpatched, treat it as potentially compromised: rotate the root SSH key, the TLS certificate and key, and the web user passwords.
- Note that CVE-2026-112351 and CVE-2026-112352 are fixed in the same release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Sunhillo SureLine product page www.sunhillo.com
- VulnCheck advisory: Sunhillo SureLine Path Traversal via radarUpdater.cgi www.vulncheck.com
- VulDB entry 427551 vuldb.com
- OffSeq radar: CVE-2026-112350 radar.offseq.com
- OffSeq radar: SureLine before 9.1.5 path traversal radar.offseq.com
- Strix CVE entry CVE-2026-112350 www.strix.ai
- Positive Technologies PT-2026-127215 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:52.
Original description (NVD)
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.