What is the CVSS score of CVE-2026-45564?

CVE-2026-45564 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Roxy Wi are affected by CVE-2026-45564?

Roxy-WI versions 8.2.6.4 and earlier contain an authenticated command injection vulnerability (CVSS 8.8) allowing low-privileged management interface users to execute arbitrary system commands on the…

How to fix or mitigate CVE-2026-45564?

Within 24 hours: Inventory all Roxy-WI deployments, confirm installed versions, and audit access logs for POST requests to /config/versions endpoints. Within 7 days: Implement network segmentation restricting Roxy-WI interface access to known administrative networks, disable or restrict user accounts with roles ≤ 3 to essential personnel only, and enable detailed logging of all POST requests. Within 30 days: Monitor vendor security advisories for patch availability; if no patch timeline is published, develop remediation plan including service decommissioning or air-gapped deployment.

Roxy Wi CVE-2026-45564

EUVD-2026-36044 HIGH

OS Command Injection (CWE-78)

2026-06-10 GitHub_M

Apache Command Injection Nginx Roxy Wi

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 15:17 vuln.today

CVE Published

Jun 10, 2026 - 14:04 nvd

HIGH 8.8

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions/<service>/<server_ip>/<configver>/save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.system(f"dos2unix -q {cfg}"). configver is not run through EscapedString (Pydantic doesn't validate path segments declared as str) and the surrounding .. block is the broken tuple-membership patch from GHSA-vapt-004. An authenticated user with role <= 3 ("user") therefore reaches a bin/sh -c command-injection sink. At time of publication, there are no publicly available patches.

Articles & Coverage 3

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026

AnalysisAI

Authenticated command injection in Roxy-WI versions 8.2.6.4 and prior allows low-privileged users (role <= 3, 'user') to execute arbitrary OS commands by abusing the configver URL-path parameter on POST /config/versions/<service>/<server_ip>/<configver>/save, which flows unsanitized into an os.system() call wrapping dos2unix. No public exploit identified at time of analysis, but the GHSA advisory is published and no vendor patch exists, leaving exposed instances at immediate risk of full compromise of the management interface host.