takenaka hiroya@Joe_Biden_ja
Sunhillo SureLine の認証回避 CVE-2026-112352（CVSS 9.8）。8.0.0 以上 9.1.5 未満で、未認証の遠隔攻撃者が有効なセッションの利用者になりすませます。修正版は 9.1.5 です。 https://ai-news.autoarticles.net/article/post_1793976315286_o7s669
0000029
558 followersView on X
CVE-2026-112352(sunhillo / sureline)
LOWCVSS 9.8 · CRITICALSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.
0.0/ 10 priority
Sources & remediation
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-565
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- sureline
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Vendors
Products
sureline
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
Full discourse1 post
CPE platform detail1 entries
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sunhillo | sureline | - | - | - |