Termix CVE-2025-59951

Exploitation requires the target to be deployed using the official Termix Docker image, a custom image built from the official Dockerfile, or any configuration placing the Termix backend behind an Nginx (or similar) reverse proxy - this is the condition that makes req.ip return the proxy's IP and forces isLocalhost to always evaluate true, exposing the /ssh/db/host/internal endpoint without login. No authentication, user interaction, or special privileges are needed against these default/common deployments. The key LIMITING factor is the deployment topology: a Termix instance running without a reverse proxy (where req.ip correctly reflects the real client IP) would not have isLocalhost spuriously satisfied and should not be exploitable; only versions 1.5.0 and below are affected, and upgrading to 1.6.0 remediates the flaw.

This is a genuinely high-priority flaw for anyone running the affected product, but the signals are mixed and worth parsing carefully. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack with high confidentiality impact (VC:H) and subsequent-system impact (SC:H), which aligns well with the description: an authentication bypass that exposes stored SSH credentials. A public exploit/advisory exists (GHSA-92cw-877q-6r94), raising real-world feasibility. However, the EPSS score is very low (0.06%, 19th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation - the low EPSS most plausibly reflects the product's limited deployment footprint rather than any difficulty of exploitation. The net picture: technically trivial to exploit against default deployments and the payoff (plaintext SSH hosts/usernames/passwords) is severe, but the blast radius is bounded by how few organizations actually run this software. Treat as urgent-to-patch for the specific population that runs it, not as a mass-exploitation event. One nuance to verify: PR:N assumes the official/default reverse-proxied Docker configuration, which the vendor states is the standard deployment - a non-proxied custom deployment may not be vulnerable.

An attacker who can reach a Termix instance deployed via the official Docker image (or any Nginx reverse-proxied build) sends a direct HTTP request to the /ssh/db/host/internal endpoint. Because Nginx makes req.ip resolve to the proxy's address, the backend's isLocalhost check always returns true and serves stored SSH host records - addresses, usernames, and passwords - with no login required. A public advisory with exploit details exists (GHSA-92cw-877q-6r94), and the low attack complexity (AC:L, no user interaction) makes this a point-and-shoot request.