Sunhillo SureLine CVE-2026-112350

No special conditions - remote unauthenticated exploitation against the radarUpdater.cgi endpoint, which lacks authentication checks and does not sanitize the filename parameter, affecting SureLine versions 8.0.0 up to (not including) 9.1.5. The only practical limit is that the device's SureLine web/CGI interface must be reachable over the network from the attacker; there is no user-interaction, authentication, or non-default-configuration requirement per the CVSS vector (PR:N/UI:N). A further scoping limit is that the direct flaw grants file read only (VC:H, VI:N/VA:N) - it is not direct code execution - but disclosure of the root SSH key, TLS private key, and credential files makes full compromise a realistic follow-on.

This is a credible near-term priority rather than a CVSS-inflated non-issue, though the signal set is incomplete. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which maximizes exploitability, and the vuln.today decision label is 'this_week' - a prioritized but not emergency urgency. The impact profile is narrow by design: VC:H with VI:N/VA:N means the primary direct consequence is confidentiality loss (arbitrary file read as root), not direct code execution or integrity/availability damage - yet because the readable files include /etc/shadow, the web user database, the root SSH private key, and the device TLS private key, the practical outcome is credential/key disclosure that enables full follow-on compromise, so the low raw I/A metrics understate real-world severity. EPSS is not provided and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation signal; exploitation status is therefore 'no public exploit identified at time of analysis,' with the caveat that a VulnCheck advisory exists and may contain technical detail. The main gaps: no EPSS probability to gauge likelihood of mass exploitation, and no independent confirmation of a working exploit, so treat the 'this_week' label as the strongest urgency signal and patch on that cadence.

An unauthenticated attacker with network access to a SureLine device's web interface sends a crafted request to the radarUpdater.cgi endpoint with directory traversal sequences in the filename parameter, retrieving the root SSH private key and TLS private key. The attacker then uses those keys to authenticate directly to the device and impersonate its TLS identity, escalating a file-read bug into full system compromise. No public working exploit is confirmed, though a VulnCheck advisory for the issue exists.