CVE-2026-112352
Received Received - Intake

Authentication Bypass in Sunhillo SureLine

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-112352
EUVD
EUVD-2026-111360

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Sunhillo Corporation SureLine 8.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-565 The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Sunhillo SureLine before version 9.1.5 has an authentication bypass flaw. An unauthenticated remote attacker can impersonate any active user by forging a session cookie with just a cleartext username, bypassing proper authentication. This allows attackers to guess default accounts like Admin or sftp_user and gain unauthorized access.

Detection Guidance

Detecting this vulnerability requires checking for Sunhillo SureLine versions before 9.1.5 and inspecting network traffic for forged session cookies. Look for cookies containing only a cleartext username without random identifiers. Monitor for unauthorized root command execution attempts via networkDiag.cgi.

Impact Analysis

This vulnerability allows attackers to impersonate legitimate users, potentially gaining unauthorized access to sensitive data or system functions. It could lead to data breaches, unauthorized command execution, or full system compromise if default accounts are exploited.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade Sunhillo SureLine to version 9.1.5 or later. Disable default accounts like Admin or sftp_user if unused. Implement network segmentation to limit access to SureLine interfaces. Monitor logs for suspicious session cookie manipulation or unauthorized command execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart