Roxy-WI CVE-2026-33076

No special conditions - remote unauthenticated exploitation against default configurations of Roxy-WI versions before 8.2.6.4. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network accessibility, low attack complexity, no authentication, and no user interaction required. Successful exploitation requires only that the Roxy-WI web interface be network-reachable by the attacker. However, realistic exploitation is LIMITED by typical deployment practices - Roxy-WI is infrastructure management software often deployed on internal management networks rather than public internet. Organizations that have exposed Roxy-WI to untrusted networks (internet-facing, DMZ without access controls, or flat networks accessible post-initial compromise) meet full exploitation conditions. The vulnerability requires write permissions to cron directories, which Roxy-WI typically possesses as it manages system service configurations.

CVSS 8.9 reflects severe baseline risk: network-based attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) with high confidentiality, integrity, and availability impact. This is a 'wormable' profile enabling automated mass exploitation. The CVSS 4.0 Exploit Maturity indicator shows E:P (proof-of-concept exists), confirmed by GitHub security advisory GHSA-mmgm-p9x9-h33j and the public commit fixing the vulnerability. However, critical risk signals are incomplete: EPSS exploitation probability unavailable, no CISA KEV listing at time of analysis, and no independent confirmation of active exploitation beyond POC. Real-world risk depends heavily on exposure - Roxy-WI is infrastructure management software typically deployed internally, reducing internet-facing attack surface compared to public web applications. Organizations exposing Roxy-WI management interfaces to untrusted networks face immediate critical risk. The RCE impact combined with unauthenticated access makes this a viable initial access vector for ransomware and infrastructure compromise, particularly targeting managed service providers or DevOps platforms. Absence from CISA KEV suggests limited observed exploitation despite public POC availability, possibly due to smaller installation base or predominant internal deployment.

An unauthenticated remote attacker sends a crafted HTTP POST request to the Roxy-WI haproxy_section_save API endpoint, embedding path traversal sequences in the file path parameter (e.g., '../../../etc/cron.d/malicious'). The application writes attacker-supplied content to the target cron file, injecting a scheduled task that executes a reverse shell command every minute. Within 60 seconds, the cron daemon executes the malicious entry, establishing persistent remote access with application or root privileges depending on cron configuration, granting the attacker control over the infrastructure management platform and potentially all managed HAProxy, Nginx, Apache, and Keepalived servers.