Sunhillo SureLine CVE-2026-112351

Requires a valid SureLine web account of any privilege level (PR:L confirmed) and network access to the device's web interface, with the target running SureLine between 8.6.0 and before 9.1.5. The concrete trigger is injecting a URL-encoded newline (%0a) or ampersand (%26) into the ipAddr or dnsAddr parameter of the networkDiag.cgi endpoint while using the ping, nslookup, or traceroute diagnostic modes; these sequences act as command separators after decoding and bypass the incomplete character denylist introduced by the CVE-2021-36380 fix. The primary limiting factor is the authentication requirement - an attacker must first obtain web credentials - but because any account suffices and no user interaction or non-default configuration is needed, the practical barrier is low. No special non-default feature must be enabled; the vulnerable diagnostic endpoint is part of normal SureLine functionality.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - consistent with the description's claim of arbitrary command execution as root. The one meaningful barrier is authentication: PR:L confirms a valid web account is required, but the description notes 'any web account' suffices, so the barrier is minimal in environments with multiple or weak accounts. A vendor patch is available and the vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. No EPSS score was supplied and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; exploitation probability cannot be quantified from the provided data. The CVE is a denylist-bypass of the earlier CVE-2021-36380 fix, which raises the practical likelihood that attackers familiar with the prior, widely-documented SureLine flaw will adapt existing techniques. Overall: a real, actionable root-level RCE gated only by low-privilege authentication, warranting prompt patching, but without confirmed in-the-wild exploitation at time of analysis.

An attacker holding any low-privilege SureLine web account (or one obtained via weak/default credentials) sends a crafted request to the networkDiag.cgi endpoint in one of the ping, nslookup, or traceroute diagnostic modes, placing a URL-encoded newline (%0a) or ampersand (%26) inside the ipAddr or dnsAddr parameter. After decoding, the injected separator terminates the intended diagnostic command and runs attacker-supplied shell commands as root, yielding full system compromise. No public exploit was identified at time of analysis, though the technique is a documented bypass of the prior CVE-2021-36380 fix.