Sunhillo vulnerabilities
We track 4 vulnerabilities in Sunhillo products. 4 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 27, 2026.
Latest Sunhillo vulnerabilities
- 9.8 Critical severity
SureLine: Reliance on Cookies without Validation and Integrity Checking
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random ide
- 8.8 High severity
SureLine: Improper Neutralization of Special Elements used in an OS Command
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipA
- 7.5 High severity
SureLine: Improper Limitation of a Pathname to a Restricted Directory
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization
- 9.8 Critical severity
Sunhillo SureLine OS Command Injection Vulnerablity Exploited
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.