Threats tagged 'ghsa-q7gg-whqr-w8f9'

Sunhillo SureLine versions prior to 9.1.5 have a path traversal vulnerability in the radarUpdater.cgi endpoint. This flaw allows unauthenticated remote attackers to read arbitrary files with root privileges by exploiting insufficient sanitization of the filename parameter. Sensitive files such as /etc/shadow, the web user database, root SSH private key, and TLS private key can be accessed, potentially leading to full system compromise.