CVE-2022-48323: Sunlogin Sunflower path traversal allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and high EPSS plus public exploit tooling make this an urgent remote code execution risk.

What it is

Sunlogin Sunflower Simplified (Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote, unauthenticated attacker can send a crafted HTTP request to execute arbitrary programs on the victim host, as shown by the /check?cmd=ping../ pattern followed by a pathname such as powershell.exe. This matters because it exposes a remote code execution path with no credentials or user interaction required.

Impact

An attacker can execute arbitrary programs on the victim host, leading to full compromise of the affected system. Given the CVSS vector, confidentiality, integrity and availability impacts are all high.

Attack surface

The flaw is reached over the network via a crafted HTTP request to the Sunlogin Sunflower service. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.56787 (99.018th percentile) and public references include an exploit-tagged Nuclei template, indicating known public exploitation tooling.

What to do

• Patch or upgrade Sunlogin Sunflower Simplified (Sunflower Simple and Personal) from version 1.0.1.43315 to a fixed release as soon as a vendor fix is available.
• If patching is not immediately possible, remove the product from direct internet exposure and restrict access to trusted networks or management VLANs.
• Block or filter HTTP requests that contain path traversal sequences such as ../ in the /check endpoint at the perimeter or host firewall.
• Monitor vendor advisories for a fixed version and apply it promptly; do not rely on version 1.0.1.43315 remaining safe.
• Run the service with least privilege and restrict its ability to launch external programs such as powershell.exe where feasible.

Detection

• Inspect HTTP logs for requests to /check with cmd parameters containing ../ or references to powershell.exe.
• Alert on unexpected child processes spawned by the Sunlogin Sunflower service, especially powershell.exe or other command interpreters.
• Monitor for outbound network connections or process execution consistent with remote command execution from the Sunflower host.
• Use the referenced Nuclei template (CNVD-2022-03672) for authorized scanning to identify exposed vulnerable instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.