# CVE-2021-36380: Sunhillo SureLine OS Command Injection Vulnerablity

Source: https://junglewise.ai/threats/cve-2021-36380-sunhillo-sureline-os-command-injection-vulnerablity  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-03-05. Updated: 2026-05-09  
License: CC BY 4.0 with a link back

CVE-2021-36380 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2024-03-05

Sunhillo SureLine contains an unauthenticated OS command injection vulnerability in /cgi/networkDiag.cgi. Attackers can execute arbitrary commands via shell metacharacters in the ipAddr or dnsAddr parameters, potentially leading to full system compromise or denial-of-service.

Technologies: [Sunhillo Sureline](https://junglewise.ai/threats/technologies/sureline). Vendors: [Sunhillo](https://junglewise.ai/threats/vendors/sunhillo).

## Quick answers

**Is CVE-2021-36380 exploited in the wild?** Yes. CVE-2021-36380 is known to be exploited in the wild, first recorded on 5 March 2024. Treat it as urgent.

**How severe is CVE-2021-36380?** Critical severity, with a CVSS score of 9.8, published 5 March 2024.

**Which products and versions are affected?** Sunhillo SureLine before 8.7.0.1.1.

**Is there a fix for CVE-2021-36380?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-36380 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2021-36380?** Check whether you run Sunhillo Sureline. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Sunhillo SureLine before 8.7.0.1.1

## Timeline

- 2021-07-26: disclosed: Technical advisory published by NCC Group
- 2021-08-13: advisory: NVD Published Date
- 2024-03-05: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

## Related threats

- [Sunhillo SureLine authentication bypass via session cookie](https://junglewise.ai/threats/cve-2026-112352-sunhillo-sureline-before-9-1-5-contains-an-authentication-bypass)
- [Sunhillo SureLine OS command injection in networkDiag.cgi](https://junglewise.ai/threats/cve-2026-112351-sunhillo-sureline-before-9-1-5-contains-an-os-command-injection)
- [Sunhillo SureLine path traversal in radarUpdater.cgi](https://junglewise.ai/threats/cve-2026-112350-sunhillo-sureline-before-9-1-5-contains-a-path-traversal)