Roxy-WI CVE-2026-33078

No special conditions - remote unauthenticated exploitation against default configurations of Roxy-WI versions prior to 8.2.6.4. The vulnerability is triggered through normal HTTP requests to the web interface's configuration management endpoints without requiring authentication, administrative privileges, or special deployment modes. Attack success depends only on network reachability to the Roxy-WI web interface (typically TCP port 8080 or 443). The haproxy_section_save function endpoint must be accessible, which is standard in default deployments as it provides core configuration management functionality.

This represents a critical real-world risk. The CVSS 4.0 vector confirms remote network-based exploitation with no authentication, low attack complexity, and no user interaction required (AV:N/AC:L/PR:N/UI:N), resulting in high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H). Proof-of-concept code exists (E:P), lowering the barrier for exploitation. The product manages critical infrastructure components (load balancers, web servers), making database compromise particularly impactful as attackers could read credentials, modify configurations, or pivot to managed infrastructure. While EPSS data is not provided, the combination of zero authentication requirements, POC availability, and infrastructure management scope suggests high real-world exploitation likelihood. Immediate patching is strongly recommended for all exposed instances.

An unauthenticated remote attacker crafts a malicious HTTP request to the Roxy-WI web interface targeting the haproxy_section_save endpoint, injecting SQL metacharacters into the server_ip URL path parameter (e.g., /config/haproxy/1' OR '1'='1). The unsanitized input flows through function calls and gets interpolated into a SQL query, allowing the attacker to execute arbitrary SQL commands such as extracting database credentials, dumping configuration data for managed HAProxy/Nginx servers, or modifying database records to inject malicious configurations that will be pushed to production infrastructure.