Skip to content
Heist/ feed
Back to feed
High

Sunhillo SureLine Path Traversal via radarUpdater.cgi

Type: advisorySources: Official CVE List

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.

Products
SureLine
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-112350
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 15:41 UTC · Revision 1

Source evidence

Sunhillo SureLine Path Traversal via radarUpdater.cgi

core-cve · Original source

Published 27 Oct 2026, 19:43 UTC

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.

cve:CVE-2026-112350

SureLine

Fixed versions: Not specified

Complete source record
{
  "id": "a8640b5d8c74c8ab7f3752bf64f42fb218e151a64d1cbe8712a18da9622c08ac",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-112350",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Sunhillo SureLine Path Traversal via radarUpdater.cgi",
    "summary": "Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.",
    "evidence": "cve:CVE-2026-112350",
    "products": [
      {
        "name": {
          "value": "SureLine",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-112350",
      "aliases": [
        "CVE-2026-112350"
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV4_0": {
            "Safety": "NOT_DEFINED",
            "version": "4.0",
            "Recovery": "NOT_DEFINED",
            "baseScore": 8.7,
            "Automatable": "NOT_DEFINED",
            "attackVector": "NETWORK",
            "baseSeverity": "HIGH",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "exploitMaturity": "NOT_DEFINED",
            "providerUrgency": "NOT_DEFINED",
            "userInteraction": "NONE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "privilegesRequired": "NONE",
            "subIntegrityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "subAvailabilityImpact": "NONE",
            "vulnAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "scope": "UNCHANGED",
            "version": "3.1",
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "integrityImpact": "NONE",
            "userInteraction": "NONE",
            "attackComplexity": "LOW",
            "availabilityImpact": "NONE",
            "privilegesRequired": "NONE",
            "confidentialityImpact": "HIGH"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "affected": [
        {
          "vendor": "Sunhillo Corporation",
          "product": "SureLine",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.0",
              "lessThan": "9.1.5",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ],
      "modified": "2026-10-27T19:43:01.386Z",
      "provider": "cve",
      "references": [
        "https://www.sunhillo.com/product/sureline/",
        "https://www.vulncheck.com/advisories/sunhillo-sureline-path-traversal-via-radarupdater-cgi"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
          "shortName": "VulnCheck",
          "dateUpdated": "2026-10-27T19:43:01.386Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-112350",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 398115,
  "published_at": "2026-10-27T19:43:01.386+00:00"
}