CVE-2021-36380

What it actually does

Sunhillo SureLine versions before 8.7.0.1.1 contain an unauthenticated operating system command injection vulnerability in /cgi/networkDiag.cgi. The vulnerable network diagnostics functionality accepts attacker-controlled values in the ipAddr or dnsAddr parameters and passes them to a shell without proper sanitization. By adding shell metacharacters, a remote attacker can execute arbitrary OS commands with the privileges of the web service process. Given the CVSS 9.8 rating and network-accessible, no-authentication attack requirements, successful exploitation can lead to full compromise of the affected appliance, including command execution, data access, configuration changes, persistence, and service disruption.

Why it matters to the business

A vulnerable SureLine device can be taken over remotely without credentials, creating risk to confidentiality, integrity, and availability of aviation/network infrastructure functions supported by the appliance. Attackers could disrupt operations, alter device configuration, use the device as a foothold into adjacent networks, or stage additional attacks from a trusted network position. This vulnerability is listed in CISA Known Exploited Vulnerabilities with a remediation due date of 2024-03-26 and has very high EPSS likelihood, indicating urgent remediation priority for any internet-exposed or operationally critical deployments.

How an attack unfolds

An attacker first identifies a reachable Sunhillo SureLine web interface and probes for the network diagnostics CGI endpoint. Because authentication is not required, the attacker submits a crafted HTTP request to /cgi/networkDiag.cgi with shell metacharacters embedded in the ipAddr or dnsAddr parameter. The application invokes the underlying diagnostic command through a shell, causing the injected payload to run as an OS command. The attacker may start with harmless commands such as id, whoami, uname, or ping to verify execution, then progress to downloading tools, opening reverse shells, modifying configuration, creating persistence, collecting credentials or configuration files, and using the appliance as a pivot point. Public exploitation has been observed in the wild, so exploitation attempts may be automated and opportunistic.

How to fix it

Upgrade Sunhillo SureLine to version 8.7.0.1.1 or later. If immediate upgrade is not possible, restrict access to the web management interface and /cgi/networkDiag.cgi to trusted administrative networks only, block external access at firewalls/VPN gateways, and disable or limit network diagnostic CGI functionality if supported by the vendor. Apply defense-in-depth controls such as management-plane segmentation, strong access control, egress filtering, and monitoring for unusual outbound connections from the appliance. Because this vulnerability is in the CISA KEV catalog and is actively exploited, mitigation should be treated as temporary; patching or replacing vulnerable versions should be prioritized.

How to confirm the fix worked

Confirm the installed SureLine version is 8.7.0.1.1 or later. Verify that /cgi/networkDiag.cgi is not reachable from untrusted networks and that management access is limited to authorized administrative paths. Perform a safe validation test in an approved maintenance window by submitting benign shell metacharacter payloads to ipAddr and dnsAddr and confirming they are rejected, escaped, or treated as invalid input rather than executed. Review web server, CGI, system, and network logs for historical requests to /cgi/networkDiag.cgi containing command separators or suspicious command names. Where available, validate that vendor patch files and firmware checksums match expected releases.

Typical attack path

1. Scan for exposed Sunhillo SureLine web management interfaces.
2. Send a request to /cgi/networkDiag.cgi to confirm the network diagnostics endpoint is reachable.
3. Inject shell metacharacters into the ipAddr or dnsAddr parameter.
4. Execute a simple validation command such as id, whoami, uname, ping, or nslookup.
5. Use command execution to retrieve payloads, establish interactive access, or enumerate the appliance.
6. Modify configuration, collect sensitive data, disrupt services, or pivot to adjacent systems.

How to detect it

Review HTTP access logs, CGI logs, reverse proxy logs, firewall logs, IDS/IPS alerts, and appliance system logs for requests to /cgi/networkDiag.cgi, especially requests with ipAddr or dnsAddr values containing shell metacharacters such as ;, &, |, `, $(), newline encodings, or URL-encoded equivalents. Look for command strings commonly used during exploitation, including id, whoami, uname, cat /etc/passwd, wget, curl, tftp, nc, netcat, busybox, chmod, sh, bash, python, perl, and ping callbacks. Correlate suspicious web requests with process execution, file creation, outbound connections, DNS lookups, or configuration changes occurring immediately afterward. Investigate any outbound connections from the SureLine appliance to unfamiliar external IP addresses, especially following web requests to the diagnostic endpoint. If logs are limited, inspect the filesystem for recently modified startup scripts, cron entries, temporary files, downloaded binaries, web-accessible dropped files, and unusual shell history or command artifacts. Because exploitation can be automated, also look for repeated probes from many source addresses and failed malformed requests targeting the same CGI path.

• /cgi/networkDiag.cgi
• ipAddr=
• dnsAddr=
• /cgi/networkDiag.cgi?ipAddr=
• /cgi/networkDiag.cgi?dnsAddr=
• ipAddr=;
• dnsAddr=;
• ipAddr=%3B
• dnsAddr=%3B
• ipAddr=|
• dnsAddr=|
• ipAddr=%7C
• dnsAddr=%7C
• ipAddr=&
• dnsAddr=&
• ipAddr=%26
• dnsAddr=%26
• ipAddr=`
• dnsAddr=`
• ipAddr=%60
• dnsAddr=%60
• ipAddr=$(
• dnsAddr=$(
• ipAddr=%24%28
• dnsAddr=%24%28
• /cgi/networkDiag.cgi?ipAddr=;id
• /cgi/networkDiag.cgi?dnsAddr=;id
• /cgi/networkDiag.cgi?ipAddr=;whoami
• /cgi/networkDiag.cgi?dnsAddr=;whoami
• /cgi/networkDiag.cgi?ipAddr=;uname
• /cgi/networkDiag.cgi?dnsAddr=;uname
• /cgi/networkDiag.cgi?ipAddr=;cat%20/etc/passwd
• /cgi/networkDiag.cgi?dnsAddr=;cat%20/etc/passwd
• /cgi/networkDiag.cgi?ipAddr=;wget
• /cgi/networkDiag.cgi?dnsAddr=;wget
• /cgi/networkDiag.cgi?ipAddr=;curl
• /cgi/networkDiag.cgi?dnsAddr=;curl
• /cgi/networkDiag.cgi?ipAddr=;busybox
• /cgi/networkDiag.cgi?dnsAddr=;busybox
• /cgi/networkDiag.cgi?ipAddr=;chmod
• /cgi/networkDiag.cgi?dnsAddr=;chmod
• /cgi/networkDiag.cgi?ipAddr=;nc
• /cgi/networkDiag.cgi?dnsAddr=;nc

What your security team should do

• Immediately inventory all Sunhillo SureLine deployments and identify versions earlier than 8.7.0.1.1.
• Prioritize patching or replacement of vulnerable devices, especially those reachable from the internet, partner networks, or broad internal networks.
• Restrict management-plane access to trusted administrative networks and require VPN or jump-host access where feasible.
• Block or alert on HTTP requests to /cgi/networkDiag.cgi containing shell metacharacters in ipAddr or dnsAddr.
• Review historical logs for evidence of exploitation because this vulnerability is KEV-listed and actively exploited in the wild.
• Hunt for post-exploitation activity from affected appliances, including unexpected outbound connections, downloaded files, new scheduled jobs, modified startup scripts, and anomalous processes.
• Apply egress filtering so appliances cannot freely initiate outbound connections to the internet except where operationally required.
• If compromise is suspected, isolate the appliance, preserve logs and firmware images, rotate credentials associated with the device, and rebuild or reimage from trusted media after patching.