Sunhillo SureLine OS Command Injection via networkDiag.cgi
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 9.1.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Sunhillo SureLine, a network monitoring product, is affected by a flaw in its networkDiag.cgi diagnostic web endpoint. An attacker with any valid web account can exploit it to run arbitrary commands with root privileges, potentially taking complete control of the system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- Sunhillo Corporation SureLine
From 8.6.0 · fixed in 9.1.5