Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck

CVE-2026-112351Sunhillo SureLine OS Command Injection via networkDiag.cgi

High 8.8

In plain English

A high-severity OS command injection in SureLine from Sunhillo Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)2.7%top 14.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.

Affected products (as reported)

Vendor	Product	Versions
Sunhillo Corporation	SureLine	8.6.0 – before 9.1.5

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Product Webpage product
VulnCheck Advisory: Sunhillo SureLine OS Command Injection via networkDiag.cgi third-party-advisory