CVE-2026-112352
Critical
Description
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.
SeverityCritical
CVSS9.1
Exploit probability—
ProductSunhillo Sureline
PublishedOct 27, 2026
First seenOct 27, 2026
Weakness typeCWE-565CWE-565
How to fix
Update
- sunhillo sureline9.1.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sunhillo sureline | 8.0.0 ≤ v < 9.1.5 | 9.1.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.