SureLine vulnerabilities
4 known vulnerabilities in SureLine from Sunhillo. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
SureLine: Reliance on Cookies without Validation and Integrity Checking
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random ide
- 8.8 High severity
SureLine: Improper Neutralization of Special Elements used in an OS Command
Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipA
- 7.5 High severity
SureLine: Improper Limitation of a Pathname to a Restricted Directory
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization
- 9.8 Critical severity
Sunhillo SureLine OS Command Injection Vulnerablity Exploited
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.