{"id":"CVE-2026-112352","published":"2026-10-27T20:17:12.997","lastModified":"2026-10-27T20:17:12.997","description":"Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-565"],"vendors":[],"products":[],"references":[{"url":"https://www.sunhillo.com/product/sureline/","tags":[]},{"url":"https://www.vulncheck.com/advisories/sunhillo-sureline-authentication-bypass-via-session-cookie","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Sunhillo SureLine before 9.1.5 has a critical authentication bypass flaw where unauthenticated attackers can forge session cookies containing only a cleartext username, enabling them to impersonate any active user—including privileged accounts like Admin or sftp_user—and gain unauthorized access to sensitive functions.","exploitability":"Exploitation is straightforward for attackers: they only need to guess common default usernames and send a forged cookie without randomness or integrity checks; no prior access or user interaction is required.","blast_radius":"Successful exploitation allows full compromise of confidentiality and integrity via root-level command execution through chained endpoints like networkDiag.cgi, potentially affecting all devices running the vulnerable firmware.","remediation":"Upgrade to Sunhillo SureLine version 9.1.5 or later, which includes proper session cookie generation with random identifiers and cryptographic integrity protection.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","rce","web","ics","credential-theft","command-execution"],"model":"garnet-coder","analyzedAt":"2026-10-28T10:04:07.784Z"}}