CVE-2021-36380

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2021
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 5, 2024
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-363815.3In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?CVE-2021-363823.7Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack agaCVE-2021-363834.3Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resoCVE-2021-363859.8A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a FuCVE-2021-363867.5report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow maiCVE-2021-363875.4In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a speciaCVE-2021-363887.5In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerCVE-2021-363897.5In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerabilityCVE-2021-36396.1A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate pCVE-2021-363929.8In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.CVE-2021-363939.8In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.CVE-2021-363949.8In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
CVE-2021-36380: Critical severity, CVSS 9.8 | Vulnix