Sunhillo SureLine CVE-2026-112352

The attacker must be able to reach the SureLine web interface over the network; no credentials are required (PR:N). The specific prerequisite from the description is that a target account must have an ACTIVE web session at the time of the attack - the forged cookie impersonates 'any user with an active web session,' so a live session for the chosen username (e.g. Admin or sftp_user) must exist; this is the AT:P attack requirement and the main limiting factor. The exploit primitive is a session cookie containing only a cleartext username with no random session identifier and no integrity protection, accepted by checkLogin in libwebcmn.so and networkDiag.cgi. Attacker must also know or guess a valid username, which is eased by documented default account names (Admin, sftp_user). Applies to SureLine versions 8.0.0 through below 9.1.5; upgrading to 9.1.5 is the vendor fix.

This is a genuine high-priority issue, not a high-CVSS/low-real-risk artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H) scores 9.1 and describes a network-reachable, unauthenticated (PR:N) authentication bypass that chains to root command execution - a near-complete compromise of the appliance. The vulnerability class (CWE-565, reliance on an unprotected cookie for a security decision) is trivially understood and the exploit primitive is a single forged cookie containing a cleartext username, so weaponization requires minimal skill. Multiple signals reinforce urgency: the vuln.today Decision label is act_now, a vendor patch is available, and VulnCheck is the reporting source. Two signals temper the picture and should be stated explicitly: this CVE is NOT listed in CISA KEV in the provided data, and no EPSS probability was supplied - so there is no confirmation of active or widespread in-the-wild exploitation; the act_now priority is driven by severity and ease of exploitation rather than observed attacks. The one real constraint is AT:P (attack requirement present): the description says the attacker impersonates a user 'with an active web session,' meaning a valid session for the forged username (e.g. Admin) must be live at the time of the forgery - a precondition outside the attacker's direct control, though easily met on an appliance where an admin is commonly logged in. Net: treat as act_now and patch immediately, while noting active exploitation is not independently confirmed here.

An unauthenticated attacker who can reach the SureLine web interface guesses a default account name such as Admin or sftp_user and submits an HTTP request carrying a forged session cookie that is just that cleartext username, with no random session identifier or integrity check. Because checkLogin (libwebcmn.so) and networkDiag.cgi accept this unprotected cookie as a valid session, the attacker is authenticated as that user and chains the access into command execution as root. No public exploit is identified in the provided data, but the technique is simple enough to reproduce from the description alone.