CVE-2021-36380
Sunhillo SureLine OS Command Injection Vulnerablity
Description
CVE-2021-36380 is a critical OS command injection vulnerability (CWE-78) in Sunhillo SureLine, a network surveillance and flight tracking software product used in aviation infrastructure. Versions before 8.7.0.1.1 are vulnerable: the /cgi/networkDiag.cgi endpoint fails to sanitize user-supplied input in the ipAddr and dnsAddr parameters, allowing unauthenticated remote attackers to inject arbitrary OS commands via shell metacharacters. Successful exploitation grants attackers full operating system access on the underlying server without any credentials or user interaction. CVE-2021-36380 carries a CVSS score of 9.8 (CRITICAL), an EPSS score of 0.936 (99.8th percentile), and has been added to CISA's Known Exploited Vulnerabilities catalog, reflecting confirmed active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sunhillo | sureline | < 8.7.0.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://research.nccgroup.com/2021/07/26/technical-advisory-sunhillo-sureline-unauthenticated-os-command-injection-cve-2021-36380/(Exploit, Third Party Advisory)
- https://www.sunhillo.com/product/sureline/(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36380(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements Used in an OS Command (OS Command Injection)
CWE-78 describes a weakness where software constructs an OS command using externally-controlled input but fails to neutralize or improperly neutralizes special characters (shell metacharacters) that can change the intended command. In CVE-2021-36380, Sunhillo SureLine's networkDiag.cgi script passes user-supplied values from the ipAddr and dnsAddr parameters directly to underlying OS commands without filtering shell metacharacters such as semicolons, pipes, or backticks, allowing attackers to append arbitrary commands.
Learn more: CWE-78 — Improper Neutralization of Special Elements Used in an OS Command
Impact Analysis
CVE-2021-36380 is rated CRITICAL with a CVSS 3.1 score of 9.8, representing maximum or near-maximum impact across all three security domains. Confidentiality is fully compromised: an unauthenticated attacker can execute arbitrary commands on the operating system, enabling them to read any file accessible to the process running the web server, including configuration files, credentials, cryptographic material, and any data stored on or accessible from the SureLine server. Integrity is fully compromised: arbitrary command execution enables the attacker to modify system files, install backdoors, alter SureLine's operational configuration, or tamper with network surveillance data. Availability is fully compromised: attackers can terminate processes, corrupt data, or shut down the SureLine system entirely, potentially disrupting the aviation or network surveillance operations that depend on it.
The attack vector is network-based with no complexity, no privileges required, and no user interaction needed — the most severe possible combination. Any attacker who can reach the SureLine web interface over the network can achieve full OS-level compromise with a single crafted HTTP request. Given that SureLine is used in aviation-related infrastructure for network surveillance and flight-related data processing, the potential impact extends beyond the immediate server to operational continuity and safety-adjacent systems. The EPSS score of 0.936 (99.8th percentile) confirms this is among the most aggressively exploited vulnerabilities in its class.
Exploit Maturity
CVE-2021-36380 has a very high real-world exploitation rate. With an EPSS score of 0.93643 and an EPSS percentile of 0.99833 (99.8th percentile), it ranks in the top 0.2% of all CVEs by predicted exploitation likelihood. CISA added it to the Known Exploited Vulnerabilities catalog with a March 26, 2024 remediation deadline, confirming that exploitation in the wild has been observed.
A detailed technical advisory was published by NCC Group in July 2021, which provided a thorough technical analysis of the vulnerability including the affected endpoint, the vulnerable parameters, and proof-of-concept demonstration of unauthenticated OS command injection. This public advisory, combined with the straightforward nature of the flaw (no authentication, low complexity, network-accessible), makes CVE-2021-36380 highly accessible to a wide range of threat actors — from automated vulnerability scanners and opportunistic attackers to more targeted adversaries interested in aviation infrastructure. The combination of critical infrastructure context (Sunhillo SureLine is used in aviation environments) and trivial exploitability makes this an especially high-priority remediation target.
Remediation
- Upgrade Sunhillo SureLine immediately: Update to version 8.7.0.1.1 or later, which contains the vendor's official patch for CVE-2021-36380. This is the definitive fix.
- Apply vendor mitigations if patching is delayed: Follow any interim guidance provided by Sunhillo if an immediate upgrade cannot be performed. Treat any delay as a critical operational risk.
- Restrict network access to the SureLine interface: Place the SureLine web interface behind a firewall or network access controls so that only authorized IP addresses and networks can reach it. If internet exposure is not necessary, remove it immediately.
- Disable or restrict the networkDiag.cgi endpoint: If the network diagnostics functionality is not required in normal operation, consider disabling the vulnerable endpoint as an interim mitigation.
- Audit for signs of compromise: Review web server logs and OS-level logs for unexpected command executions, unusual process activity, or unauthorized file modifications that may indicate prior exploitation.
- Rotate credentials and secrets: Any credentials or configuration data stored on or accessible from the SureLine server should be considered potentially compromised and rotated.
- Follow CISA KEV guidance: Comply with the CISA Known Exploited Vulnerabilities catalog requirements, including the March 26, 2024 remediation deadline for federal agencies and subject organizations.
- Implement web application firewall rules: Until patching is complete, consider deploying WAF rules that block requests to
/cgi/networkDiag.cgiwith shell metacharacters in parameters.
Technical Details
CVE-2021-36380 is an unauthenticated OS command injection vulnerability (CWE-78) in Sunhillo SureLine's web-based network diagnostics functionality. The vulnerable endpoint is /cgi/networkDiag.cgi, a CGI script that provides network diagnostic tools such as ping and DNS resolution directly accessible through the SureLine web interface.
Root cause: The CGI script accepts user-supplied input via the ipAddr (IP address) and dnsAddr (DNS address) parameters and constructs OS-level commands (such as ping or nslookup/dig) incorporating this input. The script fails to sanitize or properly escape shell metacharacters — characters such as semicolons (;), pipes (|), backticks (`), and ampersands (&) — that have special meaning to Unix/Linux shells. An attacker can inject these characters into the ipAddr or dnsAddr parameters to append arbitrary commands to the intended OS command.
Example attack pattern: A request such as ipAddr=127.0.0.1;id would cause the server to execute both the intended network diagnostic command and the injected id command. Since the CGI script runs with the web server process's OS privileges, injected commands execute in that security context. Depending on the server configuration, this may be sufficient to achieve root-level access.
No authentication required: The endpoint is accessible without any authentication, as confirmed by the NCC Group advisory. This means the attack can be launched by any network-accessible party with zero setup or credential requirements, resulting in the maximum CVSS score of 9.8. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H fully captures this risk profile.
Frequently Asked Questions
What is Sunhillo SureLine and why does this vulnerability matter for critical infrastructure?
Sunhillo SureLine is a network surveillance and data processing platform used in aviation-related environments for tracking and processing flight data and network communications. CVE-2021-36380 matters for critical infrastructure because it allows unauthenticated remote attackers to execute arbitrary operating system commands on SureLine servers, potentially disrupting aviation data services, exfiltrating sensitive operational data, or using compromised SureLine systems as a pivot point to attack adjacent networks in airport or air traffic management environments.
How difficult is it to exploit CVE-2021-36380?
Exploitation of CVE-2021-36380 is straightforward. The vulnerability requires no authentication, no special tools, and no complex exploit development. An attacker only needs network access to the SureLine web interface and the ability to send a crafted HTTP request with shell metacharacters in the ipAddr or dnsAddr parameter of /cgi/networkDiag.cgi. A detailed public technical advisory from NCC Group published in July 2021 describes the vulnerability in full, further lowering the bar for exploitation.
Is CVE-2021-36380 being actively exploited?
Yes. CISA has added CVE-2021-36380 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The EPSS score of 0.936 (99.8th percentile) indicates extremely high real-world exploitation probability. The combination of a critical CVSS score, network accessibility, no authentication requirement, and public proof-of-concept information makes this one of the most attractive targets for opportunistic attackers.
What version of Sunhillo SureLine fixes CVE-2021-36380?
CVE-2021-36380 is fixed in Sunhillo SureLine version 8.7.0.1.1 and later. All versions prior to 8.7.0.1.1 are vulnerable. Organizations running Sunhillo SureLine should upgrade to 8.7.0.1.1 or later immediately and, in the meantime, restrict network access to the SureLine web interface to authorized networks only.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.