CVE-2021-36380: Sunhillo SureLine RCE Vulnerability

CVE-2021-36380 Overview

CVE-2021-36380 is a critical unauthenticated OS command injection vulnerability affecting Sunhillo SureLine versions prior to 8.7.0.1.1. The vulnerability exists in the /cgi/networkDiag.cgi endpoint, which fails to properly sanitize user-supplied input in the ipAddr and dnsAddr parameters. Attackers can exploit this flaw by injecting shell metacharacters, allowing arbitrary command execution on the underlying operating system without any authentication requirements.

Critical Impact

This vulnerability enables remote attackers to execute arbitrary operating system commands with the privileges of the web server process, potentially leading to complete system compromise. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Affected Products

• Sunhillo SureLine versions before 8.7.0.1.1

Discovery Timeline

• 2021-07-26 - NCC Group Technical Advisory published
• 2021-08-13 - CVE CVE-2021-36380 published to NVD
• 2025-11-05 - Last updated in NVD database

Technical Details for CVE-2021-36380

Vulnerability Analysis

This command injection vulnerability resides in the network diagnostics functionality of the Sunhillo SureLine web interface. The /cgi/networkDiag.cgi script accepts user-controlled input through the ipAddr and dnsAddr parameters without implementing proper input validation or sanitization. When these parameters are passed to system shell commands (likely for network diagnostic functions such as ping or DNS lookups), an attacker can inject shell metacharacters to break out of the intended command context and execute arbitrary commands.

The unauthenticated nature of this vulnerability significantly increases its severity, as attackers do not need valid credentials to exploit it. Any network-accessible instance of vulnerable SureLine installations can be targeted remotely. Successful exploitation grants attackers command execution capabilities with the privileges of the web server process, which could potentially lead to full system compromise, data exfiltration, lateral movement, or deployment of persistent backdoors.

Root Cause

The root cause of CVE-2021-36380 is improper input validation (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The vulnerable CGI script directly incorporates user-supplied data from HTTP request parameters into shell commands without sanitizing or escaping shell metacharacters such as semicolons (;), pipes (|), backticks (`), or command substitution syntax ($()). This allows attackers to terminate the intended command and append malicious commands that will be executed by the operating system shell.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the /cgi/networkDiag.cgi endpoint with malicious shell metacharacters embedded in either the ipAddr or dnsAddr parameters. The injected commands execute with the privileges of the web server process.

For example, an attacker might inject payloads such as ; whoami or | cat /etc/passwd within the vulnerable parameters. These injected commands would then be concatenated with the legitimate diagnostic command and executed by the system shell. For detailed technical information about the exploitation mechanism, refer to the NCC Group Technical Advisory.

Detection Methods for CVE-2021-36380

Indicators of Compromise

• HTTP requests to /cgi/networkDiag.cgi containing shell metacharacters (;, |, `, $(), &&, ||) in the ipAddr or dnsAddr parameters
• Unusual process spawning from the web server process (e.g., sh, bash, wget, curl, nc)
• Unexpected outbound network connections from the SureLine device
• Creation of new user accounts or modifications to system files
• Evidence of reverse shell connections or command-and-control beaconing

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block command injection patterns in requests to /cgi/networkDiag.cgi
• Implement network intrusion detection rules to identify exploitation attempts targeting this specific endpoint
• Monitor web server access logs for suspicious requests containing encoded or unencoded shell metacharacters
• Use endpoint detection and response (EDR) solutions to monitor for anomalous process execution chains originating from web server processes

Monitoring Recommendations

• Configure alerting for any HTTP requests to the /cgi/networkDiag.cgi endpoint from external or untrusted IP addresses
• Monitor for unusual command execution patterns on SureLine devices, particularly commands commonly used in post-exploitation such as wget, curl, nc, or bash -i
• Review and correlate logs from firewalls, IDS/IPS, and SureLine devices for indicators of reconnaissance or exploitation activity
• Implement file integrity monitoring on critical system files to detect unauthorized modifications

How to Mitigate CVE-2021-36380

Immediate Actions Required

• Upgrade Sunhillo SureLine to version 8.7.0.1.1 or later immediately
• If patching is not immediately possible, restrict network access to the SureLine web interface to trusted IP addresses only
• Place SureLine devices behind a firewall and disable direct internet access
• Review system logs and web server access logs for any indicators of prior exploitation
• Conduct forensic analysis if exploitation is suspected, as CISA has confirmed this vulnerability is actively exploited

Patch Information

Sunhillo has addressed this vulnerability in SureLine version 8.7.0.1.1 and later. Organizations should upgrade to the latest available version as soon as possible. For product information, visit the Sunhillo Sureline Product Page. Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies are required to remediate according to CISA's binding operational directives, and all organizations should prioritize patching.

Workarounds

• Implement strict network segmentation to isolate SureLine devices from untrusted networks
• Configure firewall rules to block external access to the web management interface, particularly the /cgi/networkDiag.cgi endpoint
• Deploy a reverse proxy or WAF with rules to filter requests containing shell metacharacters in the vulnerable parameters
• Disable the network diagnostics feature if it is not operationally required

# Example firewall rule to restrict access to SureLine web interface (iptables)
# Replace 192.168.1.0/24 with your trusted management network
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP