CVE-2026-112350 in SureLine
Summary
by MITRE • 10/27/2026
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Sunhillo SureLine versions prior to 9.1.5 represents a critical security flaw within the radarUpdater.cgi endpoint, classified under CWE-22 as Improper Limitation of a Pathname to a Restricted Directory. This path traversal issue stems from two primary technical deficiencies: the complete absence of authentication mechanisms for this specific CGI script and insufficient sanitization of user-supplied input passed via the filename parameter. Because the application fails to validate or restrict the directory structure contained within the provided file path, an attacker can manipulate the request to traverse up the filesystem hierarchy using standard directory traversal sequences such as dot-dot-slash characters. This lack of boundary enforcement allows external actors to bypass intended access controls and interact with files located outside the designated web root or application-specific directories.
The operational impact of this vulnerability is severe due to the execution context in which the radarUpdater.cgi script operates. The process runs with elevated privileges, effectively granting it root-level permissions on the underlying operating system. Consequently, an unauthenticated remote attacker can exploit this flaw not only to read sensitive configuration files but also to access critical security assets that are typically protected by strict file permission settings. By leveraging the path traversal technique, attackers can retrieve highly confidential data including the /etc/shadow file which contains hashed user passwords, the web user database containing credentials for administrative interfaces, and cryptographic keys such as the root SSH private key and the device's TLS private key. The exposure of these specific artifacts fundamentally undermines the integrity and confidentiality guarantees provided by the system architecture.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates multiple attack vectors including Initial Access through unauthenticated exploitation and Credential Access via the harvesting of password hashes and SSH keys. Once an attacker obtains the root SSH private key or valid user credentials from /etc/shadow, they can establish persistent remote access to the device without detection by standard authentication monitoring tools. Furthermore, possession of the TLS private key allows for potential man-in-the-middle attacks against encrypted communications managed by the device, enabling decryption of traffic and further lateral movement within a network segment where these devices are deployed. This combination of unauthenticated file read capabilities with root-level execution privileges creates a direct pathway to full system compromise, allowing attackers to modify firmware, install backdoors, or exfiltrate proprietary operational data.
Mitigation strategies must prioritize immediate remediation through software updates. Organizations running Sunhillo SureLine versions earlier than 9.1.5 should upgrade to the patched version where developers have implemented proper authentication checks for the radarUpdater.cgi endpoint and enforced strict input validation on filename parameters to prevent directory traversal sequences from being processed. In environments where patching is not immediately feasible, network-level controls such as firewall rules restricting access to management interfaces or specific CGI endpoints can provide temporary relief by limiting exposure to untrusted networks. Additionally, implementing file integrity monitoring solutions can help detect unauthorized changes to critical system files like /etc/shadow and private key stores, providing early warning indicators of potential exploitation attempts even if the underlying vulnerability remains present in older deployments.