{"id":"CVE-2026-112350","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-112350","generatedAt":"2026-10-28T01:12:15.205Z","title":"Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient…","description":"Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise.","published":"2026-10-27T20:17:13.000Z","lastModified":"2026-10-27T20:17:13.000Z","status":"Received","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-22"],"affected":[],"epss":null,"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unscored. Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-27T20:17:13.000Z","detail":{"score":"8.7","severity":"HIGH","publishedAt":"2026-10-27T20:17:12.693Z"},"summary":"New CVE, high severity (CVSS 8.7)."}],"references":[{"url":"https://www.sunhillo.com/product/sureline/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/sunhillo-sureline-path-traversal-via-radarupdater-cgi","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-112350","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}