OS Command Injection (CVE‑2021‑36380) in Sunhillo SureLine Enables DoS and Persistent Access
What It Is — Sunhillo SureLine’s web interface contains an OS command injection flaw in the /cgi/networkDiag.cgi endpoint, allowing unsanitized ipAddr or dnsAddr parameters to execute arbitrary shell commands.
Exploitability — Listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog; proof‑of‑concept code is publicly available. An attacker can cause denial‑of‑service or embed a persistent foothold on the network. CVSS v3.1 base score 7.5 (High).
Affected Products — Sunhillo SureLine telephony devices (all firmware versions prior to the vendor’s March 2022 patch).
Why It Matters for Trust & Control Assurance
- Continuous vulnerability monitoring and timely remediation are core control objectives; evidence of patching demonstrates due diligence.
- Maintaining auditable remediation records satisfies multiple framework requirements (e.g., NIST CSF “Respond” and “Recover” functions).
- Persistent footholds via network devices expand the attack surface; mapping this finding to your control inventory ensures remediation is tracked enterprise‑wide.
Recommended Actions
- Inventory every Sunhillo SureLine instance and verify current firmware levels.
- Deploy Sunhillo’s security patch or apply vendor‑recommended mitigations (e.g., input validation at the perimeter).
- Update your vulnerability‑management process to capture remediation evidence for audit readiness.
- Document incident‑response steps and retain logs as proof of control effectiveness.
Source: CISA KEV – CVE‑2021‑36380