Vendor
Sunhillo SureLine versions before 9.1.5 allow unauthenticated attackers to forge session cookies for arbitrary user impersonation and root-level command execution.