CVE-2026-112352

CriticalCVSS 9.8/10Last modified Nov 3, 2026

Description

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-565

Affected software

Vendor	Product	Versions
Sunhillo Corporation	SureLine	>= 8.0.0, < 9.1.5

References

https://www.sunhillo.com/product/sureline/Product
https://www.vulncheck.com/advisories/sunhillo-sureline-authentication-bypass-via-session-cookieThird Party Advisory

Timeline

Published: Oct 27, 2026
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1123538.2GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that al CVE-2026-1123549.8Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials CVE-2026-1123557.5The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers CVE-2026-1123566.1GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a CVE-2026-1123577.8GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vu CVE-2026-1123584.1A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function g CVE-2026-1123597.5Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Le CVE-2026-112368.3Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the r CVE-2026-1123608.0A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/d CVE-2026-1123616.3A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the CVE-2026-1123629.1@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with th CVE-2026-1123635.3Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated