CVE-2026-112352
CVE-2026-112352 · Sunhillo SureLine Authentication Bypass via Session Cookie
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.
CVSS 9.1 · Critique · EPSS 1,3% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
sureline
- Versions du logiciel
- ≥ 8.0.0, < 9.1.5: Concernée (semver)
Mettez à jour vers 9.1.5