7.5
HighCVSS 3.1 · from VulnCheck
CVE-2026-112350
Sunhillo SureLine Path Traversal via radarUpdater.cgi
SureLine · Path traversal · CWE-22AffectedSureLine
FixUpdate to 9.1.5 or newer
PublishedOct 27, 19:43 · VulnCheck
ScoredOct 27 · 7.5 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read data. CVSS impact.
Description
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inSureLine8.0.0 – before 9.1.59.1.5
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known