Sunhillo SureLine: OS command injection in networkDiag.cgi
Summary
Sunhillo SureLine before 9.1.5 contains an OS command injection flaw in the networkDiag.cgi web diagnostics endpoint (ipAddr and dnsAddr parameters). An authenticated attacker with any web account can execute arbitrary commands as root by using URL-encoded newline or ampersand sequences that bypass the incomplete denylist of the earlier fix for CVE-2021-36380. Successful exploitation leads to full compromise of the system.
Affected
- Sunhillo SureLine 8.6.0 to before 9.1.5 (lower bound 8.6.0 per aggregators, not verified against the vendor)
- Versions below 8.6.0: Unknown.
Fixed in
- Upgrade to Sunhillo SureLine 9.1.5 or later.
Workaround
- No vendor workaround known.
- Restrict access to the web management interface to administrative networks.
- Block external access to /cgi/networkDiag.cgi with firewall or WAF rules and alert on requests to this endpoint from untrusted addresses.
Exploitation
- Not known to be exploited for this CVE; no public exploit code indexed at the time of research.
- The predecessor flaw CVE-2021-36380 is listed in the CISA KEV catalog and reportedly is being actively exploited against Sunhillo SureLine devices, so probing of this endpoint family should be assumed.
- Exploitation requires a valid web account.
Our recommendation
- Inventory all SureLine instances and confirm their versions; anything below 9.1.5 is in scope.
- Patch to 9.1.5 with priority after checking the vendor advisory and release notes.
- Until patched, restrict management interface access to admin networks and review logs for requests to networkDiag.cgi.
- Patch CVE-2026-112352 and CVE-2026-112350 in the same window.
- Verify that no device was exposed or compromised while running the 2021-vulnerable version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: Sunhillo SureLine OS Command Injection via networkDiag.cgi www.vulncheck.com
- Sunhillo SureLine product page www.sunhillo.com
- VulDB entry CVE-2026-112351 vuldb.com
- Offseq radar: CVE-2026-112351 radar.offseq.com
- Strix: CVE-2026-112351 www.strix.ai
- Positive Technologies PT-2026-127216 vulners.com
- SonicWall: Sunhillo SureLine command injection vulnerability securitynews.sonicwall.com
- CVE-2021-36380 at CVEdetails www.cvedetails.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:52.
Original description (NVD)
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.