An unauthenticated remote attacker can take over active web sessions on Sunhillo SureLine before 9.1.5 by forging a cleartext username cookie, and can chain this into root command execution.
What Is It
CVE-2026-112352 is an authentication bypass in Sunhillo SureLine. The session cookie holds only a cleartext username. It has no random identifier and no integrity protection. An attacker can forge this cookie to impersonate any user who has an active web session.
According to the NVD description, attackers can guess default account names such as Admin or sftp_user and send a forged username cookie. That cookie satisfies the login check in checkLogin (in libwebcmn.so) and in networkDiag.cgi. From there the attacker can chain into root command execution.
The weakness is classified as CWE-565: relying on cookies without validation and integrity checking.
Why It Matters
VulnCheck scored this flaw 9.1 CRITICAL under both CVSS 3.1 and CVSS 4.0.
- CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Attack conditions: exploitable over the network, with low complexity, no privileges, and no user interaction.
- Impact: high impact to confidentiality and integrity.
- CVSS 4.0 note: the 4.0 vector marks Attack Requirements as Present. This matches the condition in the description that the targeted user must have an active web session.
The flaw leads to root command execution, so a successful attack could give full control of the affected device.
KEV status: No CISA KEV entry was supplied for this CVE. The provided sources do not confirm active exploitation. The NVD record is in "Received" status and was published on 2026-10-27.
What's Vulnerable
- Vendor: Sunhillo Corporation
- Product: SureLine
- Affected versions: 8.0.0 up to, but not including, 9.1.5
- Affected components: session validation in
checkLogin(libwebcmn.so) andnetworkDiag.cgi
The record lists no other versions as affected.
Patch Status
The vulnerability affects SureLine versions before 9.1.5. That range suggests version 9.1.5 addresses the flaw, but the supplied sources do not include a vendor statement confirming a fix in that release. Organizations running SureLine 8.0.0 through any release before 9.1.5 should check with Sunhillo that 9.1.5 or later fixes the issue before treating it as remediated.
The supplied data includes no CISA-mandated required action or due date, because the KEV entry is empty. Check the VulnCheck advisory and the Sunhillo product page for vendor guidance.