---
id: CVE-2026-112351
title: Sunhillo SureLine OS Command Injection via networkDiag.cgi
summary: >-
  Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability
  in the networkDiag.cgi endpoint that allows an authenticated remote attacker
  with any web account to execute arbitrary commands as root by injecting shell
  meta…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: Sunhillo Corporation
product: SureLine
affected:
  - SureLine >= 8.6.0 < 9.1.5
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T19:43:42.029Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112351'
references:
  - url: 'https://www.sunhillo.com/product/sureline/'
    label: Product Webpage
  - url: >-
      https://www.vulncheck.com/advisories/sunhillo-sureline-os-command-injection-via-networkdiag-cgi
    label: >-
      VulnCheck Advisory: Sunhillo SureLine OS Command Injection via
      networkDiag.cgi
tags:
  - cve.org
ingestedAt: '2026-10-27T19:54:27.798Z'
---

## Overview

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise.

## Affected

- `SureLine >= 8.6.0 < 9.1.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.