Roxy-WI CVE-2026-45552

Exploitation requires (1) network access to the Roxy-WI web interface, (2) any authenticated session on the Roxy-WI application - including the default guest role 4, with no admin role required - and (3) a multi-tenant Roxy-WI deployment where the target server_ip is registered under a different tenant whose stored SSH credential has sudo on the target host (the standard Roxy-WI management configuration). Limiting factors: single-tenant deployments with no untrusted users gain nothing for an attacker since those users already have legitimate management rights; deployments that disabled or never provisioned non-admin accounts effectively reduce the unauthenticated attack surface to whatever protects login. No user interaction is needed, and the vulnerable endpoints are the install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status routes in app/routes/install/routes.py.

The CVSS 9.9 score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is well aligned with the technical reality: network reachability, low complexity, only a low-privilege account required, no user interaction, and a Scope change because the bug in the web app yields root execution on downstream managed hosts via Ansible. No EPSS score, KEV listing, or POC was provided in the intelligence feed, so this is best characterized as a high-severity unpatched issue without confirmed in-the-wild use. The real-world risk is amplified for multi-tenant Roxy-WI deployments where guest accounts exist or self-registration is enabled, and dampened for single-tenant installs where every user is already trusted with full server access. Because the vendor advisory explicitly states no patch is available, defenders must treat this as an open exposure window rather than a patch-now item.

An attacker obtains or is issued a low-privilege Roxy-WI account (e.g., the default guest role 4) on a multi-tenant Roxy-WI instance, enumerates server_ip values belonging to another tenant from the UI or API, then issues a POST to the install_exporter, install_waf, or install_geoip endpoint specifying the victim tenant's server_ip. Roxy-WI executes the corresponding Ansible playbook against that host using the victim tenant's stored SSH credential with sudo, giving the attacker root-equivalent command execution on a server they should have no access to. No public POC is referenced in the advisory, but the bug is trivially reproducible from the route source and requires only an authenticated HTTP request.