Path Traversal Vulnerability in Sunhillo SureLine by Sunhillo

CVE-2026-112350

What is CVE-2026-112350?

Sunhillo SureLine versions before 9.1.5 contain a path traversal vulnerability in the radarUpdater.cgi endpoint. This flaw enables unauthenticated remote attackers to read arbitrary files with root privileges due to inadequate authentication checks and insufficient sanitization of the filename parameter. Exploitation of this vulnerability could allow attackers to leverage directory traversal sequences to access highly sensitive files, including /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, resulting in potential full system compromise.

References