Sunhillo SureLine wave — zero-entropy session cookie, incomplete-fix denylist bypass, and the ungated updater CGI (CVE-2026-112352 / -112351 / -112350)¶
Source: GHSA published wave 2026-10-27 21:33Z. Sunhillo SureLine (radar/weather data distribution appliance, widely deployed at NWS/aviation weather sites) before 9.1.5 shipped three boundary defects that chain from unauthenticated network position to root. All three GHSAs carry empty package-version fields (vendor-appliance fingerprinting pattern — band from the vendor product page plus VulnCheck advisories). Not KEV'd as of catalog 2026.10.27 — head-start window open, and this is a standing-perimeter appliance class.
The three legs¶
| Advisory | CVE | Sev. | Primitive |
|---|---|---|---|
| GHSA-rvgw-426x-67hr | CVE-2026-112352 | critical 9.1 | Auth bypass: the session cookie IS the cleartext username — no random identifier, no integrity protection. Forge username=Admin (or sftp_user and other defaults) and the login check in checkLogin (libwebcmn.so) accepts it for every gated CGI, chaining into root command execution. |
| GHSA-x64r-r4gj-xh6q | CVE-2026-112351 | high 8.8 | Root command injection in networkDiag.cgi via ipAddr/dnsAddr in ping/nslookup/traceroute modes. The prior fix (CVE-2021-36380) shipped a character denylist — bypassed with URL-encoded %0a (newline) or %26 (&) separators that only materialize after decoding. |
| GHSA-q7gg-whqr-w8f9 | CVE-2026-112350 | high 7.5 | Unauthenticated path traversal in radarUpdater.cgi (filename parameter) — the endpoint never calls the login check at all. Root-privileged arbitrary file read: /etc/shadow, the web user database, the root SSH private key, and the device TLS private key. |
Durable operator rules¶
- Zero-entropy session identity is a grep, not a guess. A session cookie containing only a cleartext username (no random token, no signature) means username enumeration = session forgery. Black-box probe battery for any cookie-authenticated appliance: (1) send
Cookie: username=<default-name>with no other value — acceptance at Admin's privilege with a byte-guessable identity is the finding; (2) diff against a genuinely invalid username to separate "cookie parsed as identity" from "auth layer absent". Default-account names (Admin,sftp_user,monitor, product-name variants) come from the vendor manual — documentation is the attack corpus for appliances. White-box fingerprint: session-validate functions doing store-lookup-or-string-equality with no HMAC/random component (checkLogin-style shared library checks called per-CGI). - Incomplete-fix differential: re-run the old payload class against the "fixed" filter. CVE-2021-36380's fix was a character denylist; the 2026 bypass is simply separators the denylist never listed (
%0a,%26) that decode before the shell leg. Standing rule for security-diagnostic endpoints (ping/nslookup/traceroute/dig forms): after identifying a prior CVE fix, enumerate the full shell-separator vocabulary post-decode —;|&&&||newline carriage-return backtick$()and their URL-encoded forms — across every mode selector on the endpoint. Validation-before-decode = the sanitizer sees the encoded bytes, the consumer sees the decoded metacharacter (decode-after-validation family; sibling of the Oct 27 PhpSpreadsheet charset/encoding legs). - Sweep auth gates per-CGI, not per-product. The auth bypass leg works because
checkLoginis consulted by most endpoints; the traversal leg works becauseradarUpdater.cginever consults it at all. On any.cgi//cgi-bin/appliance surface, enumerate every CGI from the server banner, JS bundles, firmware image, or 403-vs-404 differencing, and run the anonymous battery per endpoint — updater, backup, and telemetry CGIs are the classic forgot-the-gate family (sibling of the Oct 9 Nginx UI missed-router leg and the standing sibling-route authz-drift rule). - Appliance private keys are the report. The traversal reads the root SSH private key and the TLS private key with root privileges and no authentication. On authorized engagements this is a full-finding class by itself (passive decryption position + lateral SSH identity), and it upgrades any adjacent foothold work. Proof boundary: read a non-secret marker (e.g.
/etc/hostname) first; only pull key material if scope explicitly allows, and never retain third-party TLS keys. - Product-lineage sweep: SureLine shares the radar/weather-appliance perimeter with the OT pages on this wiki (openPDC/openHistorian Sept 16, Siemens OT Oct 13, HPE ClearPass Oct 7). When an appliance vendor in a scoped perimeter produces one boundary bug, batch-probe siblings for (a) cookie-shape identity, (b) diagnostic-form injection, (c) unauthenticated updater endpoints — those three shapes are how this whole class keeps landing.
Validation boundaries¶
Authorized engagements on owned/customer-approved SureLine instances only. Fingerprint by version banner/firmware against the 9.1.5 fix band first. Cookie-forgery probe with your own session identity or an account the customer designates; command-injection proof with inert marker files (touch /tmp/<marker>) inside ping/nslookup modes, never pivot-pivoting; traversal proofs to /etc/hostname-class non-secret files. No KEV entry as of 2026.10.27 — treat KEV-addition as the mobilization signal and re-check before engagements. Not KEV'd also means no public exploitation reports at scan time: keep evidence quiet, appliance crash = weather-operations outage.
Cross-references¶
- Sibling-route/auth-gate drift canon: Sept 21 auth-precedence page; Oct 9 Nginx UI incomplete-fix router family.
- Decode-after-validation + shell-separator batteries: June 9 shell-quote page and the Oct 27 PhpSpreadsheet encoding-leg fold on the July 23 page.
- Appliance private-key disclosure as first-class finding: Sept 16 OT plane page (openPDC measurement topology), Oct 14 NGINX Gateway Fabric cross-namespace TLS key read.
- Old-CVE fix-differential discovery: Airflow fix-range differential rule (Oct 2 page) — same idea applied to a vendor denylist rather than a code path.