Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-112352 Details

Description

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:9.1 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.sunhillo.com/product/sureline/	[email protected]	Product
https://www.vulncheck.com/advisories/sunhillo-sureline-authentication-bypass-via-session-cookie	[email protected]	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-565	Reliance on Cookies without Validation and Integrity Checking	[email protected]

Affected Products

Product	Versions
sunhillo sureline	>= 8.0.0, < 9.1.5
CPE cpe:2.3:a:sunhillo:sureline:::::::: Remediation No remediation found in references.

Change History

3 change records found show changes

Date	Action	Recorded By
Nov 3, 2026	Initial Analysis	[email protected]
Oct 28, 2026	CVE Modified	CISA-ADP
Oct 27, 2026	New CVE Received	[email protected]