# CVE-2026-112352: Sunhillo SureLine authentication bypass via session cookie

Source: https://junglewise.ai/threats/cve-2026-112352-sunhillo-sureline-before-9-1-5-contains-an-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-112352 · Severity: critical · CVSS 9.1 · Published 2026-10-27

Sunhillo SureLine is a web-based appliance management system used to administer network infrastructure. An unauthenticated attacker can forge a session cookie with only a cleartext username to bypass authentication and impersonate any user, then execute commands with root privileges on the appliance.

Technologies: [Sunhillo Sureline](https://junglewise.ai/threats/technologies/sureline). Vendors: [Sunhillo](https://junglewise.ai/threats/vendors/sunhillo).

## Quick answers

**Is CVE-2026-112352 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112352 being exploited in the wild.

**How severe is CVE-2026-112352?** Critical severity, with a CVSS score of 9.1, published 27 October 2026.

**Which products and versions are affected?** Sunhillo Sureline 8.0.0 before 9.1.5.

**Is there a fix for CVE-2026-112352?** Yes: fixed in SureLine 9.1.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112352 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-112352?** Check whether you run Sunhillo Sureline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SureLine 9.1.5

## Technical details

The vulnerability exists in the checkLogin function within libwebcmn.so and networkDiag.cgi, which validates session cookies based solely on a cleartext username without cryptographic integrity checks or random identifiers. An unauthenticated remote attacker can forge a session cookie containing a guessed default account name (such as "Admin" or "sftp_user") to satisfy the login check and gain authenticated access, chaining into arbitrary root command execution.

## Affected products

- Sunhillo SureLine 8.0.0 before 9.1.5

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.sunhillo.com/product/sureline/](https://www.sunhillo.com/product/sureline/)
- [https://www.vulncheck.com/advisories/sunhillo-sureline-authentication-bypass-via-session-cookie](https://www.vulncheck.com/advisories/sunhillo-sureline-authentication-bypass-via-session-cookie)

## Related threats

- [Sunhillo SureLine OS command injection in networkDiag.cgi](https://junglewise.ai/threats/cve-2026-112351-sunhillo-sureline-before-9-1-5-contains-an-os-command-injection)
- [Sunhillo SureLine path traversal in radarUpdater.cgi](https://junglewise.ai/threats/cve-2026-112350-sunhillo-sureline-before-9-1-5-contains-a-path-traversal)
- [Sunhillo SureLine OS Command Injection Vulnerablity](https://junglewise.ai/threats/cve-2021-36380-sunhillo-sureline-os-command-injection-vulnerablity)