Sunhillo SureLine: Authentication bypass and remote code execution (CVE-2026-112352)

Sunhillo SureLine versions prior to 9.1.5 contain an authentication bypass vulnerability. The application utilizes a weak session management implementation where the session cookie contains only a cleartext username without integrity protection or randomness. An unauthenticated remote attacker can forge this cookie to impersonate any user, including privileged accounts, to bypass the authentication checks located in 'checkLogin' (within 'libwebcmn.so') and 'networkDiag.cgi'. Successful exploitation can lead to root-level command execution.

Attack Chain

1. Attacker performs reconnaissance to identify default account names such as Admin or sftp_user.
2. Attacker crafts a malicious HTTP request with a forged session cookie containing the target username.
3. The web application receives the forged cookie and fails to validate integrity or session authenticity.
4. The 'checkLogin' function in 'libwebcmn.so' incorrectly validates the session based on the forged cookie.
5. The attacker gains authenticated access to 'networkDiag.cgi'.
6. Attacker leverages 'networkDiag.cgi' functionality to execute arbitrary commands with root privileges.

Impact

Successful exploitation allows unauthenticated remote attackers to gain full administrative access and execute arbitrary commands as the root user, leading to a complete compromise of the affected network appliance.

Recommendation

1. Upgrade Sunhillo SureLine to version 9.1.5 or later immediately.
2. Restrict access to the SureLine management web interface to trusted management networks only to minimize exposure to unauthenticated attackers.