# CVE-2026-112351: Sunhillo SureLine OS command injection in networkDiag.cgi

Source: https://junglewise.ai/threats/cve-2026-112351-sunhillo-sureline-before-9-1-5-contains-an-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-112351 · Severity: high · CVSS 8.8 · Published 2026-10-27

Sunhillo SureLine is a network diagnostic appliance that performs system monitoring and remote troubleshooting functions. An authenticated attacker can execute arbitrary commands as root by injecting shell metacharacters into diagnostic tool parameters, bypassing previous security fixes. This enables full compromise of the affected system with no user interaction required.

Technologies: [Sunhillo Sureline](https://junglewise.ai/threats/technologies/sureline). Vendors: [Sunhillo](https://junglewise.ai/threats/vendors/sunhillo).

## Quick answers

**Is CVE-2026-112351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112351 being exploited in the wild.

**How severe is CVE-2026-112351?** High severity, with a CVSS score of 8.8, published 27 October 2026.

**Which products and versions are affected?** Sunhillo Sureline 8.6.0 to before 9.1.5.

**Is there a fix for CVE-2026-112351?** Yes: fixed in SureLine 9.1.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112351 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-112351?** Check whether you run Sunhillo Sureline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SureLine 9.1.5

## Technical details

OS command injection via incomplete input validation in the networkDiag.cgi endpoint affecting the ipAddr and dnsAddr parameters in ping, nslookup, and traceroute diagnostic modes. Attackers with valid web authentication can bypass a prior character denylist by using URL-encoded newline (%0a) and ampersand (%26) sequences that decode to command separators. The vulnerability requires prior authentication but results in remote code execution as root.

## Affected products

- Sunhillo SureLine 8.6.0 to before 9.1.5

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.sunhillo.com/product/sureline/](https://www.sunhillo.com/product/sureline/)
- [https://www.vulncheck.com/advisories/sunhillo-sureline-os-command-injection-via-networkdiag-cgi](https://www.vulncheck.com/advisories/sunhillo-sureline-os-command-injection-via-networkdiag-cgi)

## Related threats

- [Sunhillo SureLine authentication bypass via session cookie](https://junglewise.ai/threats/cve-2026-112352-sunhillo-sureline-before-9-1-5-contains-an-authentication-bypass)
- [Sunhillo SureLine path traversal in radarUpdater.cgi](https://junglewise.ai/threats/cve-2026-112350-sunhillo-sureline-before-9-1-5-contains-a-path-traversal)
- [Sunhillo SureLine OS Command Injection Vulnerablity](https://junglewise.ai/threats/cve-2021-36380-sunhillo-sureline-os-command-injection-vulnerablity)