Sunhillo · SureLine

CVE-2021-36380

Sunhillo SureLine OS Command Injection Vulnerablity

Exploited in attacks Critical 9.8 Attack chance: 98%

What it is

Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.

CISA: Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: March 26, 2024

Added to the CISA list: March 5, 2024
Published: August 13, 2021
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 98% in the top 0.1% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (2)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.