Sunhillo
Monthly
Sunhillo SureLine deployments running versions 8.0.0 through below 9.1.5 accept session cookies that contain nothing but a cleartext username, letting an unauthenticated remote attacker impersonate a logged-in user and chain that access into root command execution through networkDiag.cgi. The main limiting prerequisite is that the targeted account must already hold an active web session at attack time, and default account names such as Admin or sftp_user make the username guesswork trivial. The vendor has released SureLine 9.1.5 as the fix and prioritization guidance marks this as act_now; no CISA KEV listing or verified working exploit code is present in the available data.
Sunhillo SureLine deployments running versions 8.0.0 through below 9.1.5 accept session cookies that contain nothing but a cleartext username, letting an unauthenticated remote attacker impersonate a logged-in user and chain that access into root command execution through networkDiag.cgi. The main limiting prerequisite is that the targeted account must already hold an active web session at attack time, and default account names such as Admin or sftp_user make the username guesswork trivial. The vendor has released SureLine 9.1.5 as the fix and prioritization guidance marks this as act_now; no CISA KEV listing or verified working exploit code is present in the available data.