{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/sunhillo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sunhillo:sureline:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-112352"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SureLine (\u003c 9.1.5)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","remote-code-execution","network-appliance"],"_cs_type":"advisory","_cs_vendors":["Sunhillo"],"content_html":"\u003cp\u003eSunhillo SureLine versions prior to 9.1.5 contain an authentication bypass vulnerability. The application utilizes a weak session management implementation where the session cookie contains only a cleartext username without integrity protection or randomness. An unauthenticated remote attacker can forge this cookie to impersonate any user, including privileged accounts, to bypass the authentication checks located in 'checkLogin' (within 'libwebcmn.so') and 'networkDiag.cgi'. Successful exploitation can lead to root-level command execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify default account names such as Admin or sftp_user.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request with a forged session cookie containing the target username.\u003c/li\u003e\n\u003cli\u003eThe web application receives the forged cookie and fails to validate integrity or session authenticity.\u003c/li\u003e\n\u003cli\u003eThe 'checkLogin' function in 'libwebcmn.so' incorrectly validates the session based on the forged cookie.\u003c/li\u003e\n\u003cli\u003eThe attacker gains authenticated access to 'networkDiag.cgi'.\u003c/li\u003e\n\u003cli\u003eAttacker leverages 'networkDiag.cgi' functionality to execute arbitrary commands with root privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to gain full administrative access and execute arbitrary commands as the root user, leading to a complete compromise of the affected network appliance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Sunhillo SureLine to version 9.1.5 or later immediately.\u003c/li\u003e\n\u003cli\u003eRestrict access to the SureLine management web interface to trusted management networks only to minimize exposure to unauthenticated attackers.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-28T00:13:52Z","date_published":"2026-10-28T00:13:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sunhillo-sureline-auth-bypass/","summary":"Sunhillo SureLine versions before 9.1.5 allow unauthenticated attackers to forge session cookies for arbitrary user impersonation and root-level command execution.","title":"Sunhillo SureLine: Authentication bypass and remote code execution (CVE-2026-112352)","url":"https://feed.craftedsignal.io/briefs/2026-10-sunhillo-sureline-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Sunhillo","version":"https://jsonfeed.org/version/1.1"}