Sunhillo SureLine: Authentication bypass via forged session cookie
Summary
Sunhillo SureLine before 9.1.5 trusts a web session cookie that contains only a cleartext username, without any random identifier or integrity protection. An unauthenticated remote attacker can forge such a cookie for a known or guessable account such as Admin or sftp_user and impersonate that user. The advisory describes chaining this into root command execution through the networkDiag.cgi component.
Affected
- Sunhillo SureLine 8.0.0 up to but not including 9.1.5
- Sunhillo SureLine 9.1.0 to 9.1.4 are within the affected range per the CNA record
- Default configuration: unaffected (per CNA record)
Fixed in
- Fixed in SureLine 9.1.5
Workaround
- No vendor workaround identified.
- Restrict the SureLine web interface to a management network and block internet access to it until 9.1.5 is applied.
- Review active sessions and user accounts.
Exploitation
- Not known to be exploited in the wild (OffSeq, vendor-neutral threat intelligence; not confirmed by the vendor or CISA).
- No public proof-of-concept found in the sources checked; absence of public exploit code is not confirmed.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- If SureLine is in use, upgrade to 9.1.5 with priority.
- Check whether the web interface is reachable from the internet and restrict it to a management network.
- Review active sessions and accounts for unexpected activity.
- If SureLine is not in use, no action is needed beyond confirming that.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Sunhillo SureLine product page www.sunhillo.com
- VulnCheck advisory: Sunhillo SureLine Authentication Bypass via Session Cookie www.vulncheck.com
- VulDB entry CVE-2026-112352 vuldb.com
- OffSeq threat entry CVE-2026-112352 radar.offseq.com
- Strix CVE-2026-112352 (affected range) www.strix.ai
- Positive Technologies PT-2026-127217 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:18.
Original description (NVD)
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.