Termix Desktop CVE-2026-45745

Exploitation requires the attacker to hold a network position between the Termix Desktop client and the configured Termix server (rogue/open Wi-Fi, ARP or DNS spoofing on a LAN, compromised upstream router, or a hostile VPN/proxy) - this is the AC:H factor and is the primary limiting condition. The victim must be running Termix Desktop version 1.7.0 or later (the Electron build specifically; the browser-based web UI is not affected) and must perform a login or active session action while the attacker is intercepting (UI:R). No authentication or prior access to the Termix server is needed on the attacker's side (PR:N), and no special server-side configuration is required - the TLS validation is disabled in the client by default for all 1.7.0+ installations.

Signals are mixed and should be weighed together rather than reading CVSS 8.0 in isolation. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) accurately reflects that exploitation is unauthenticated and yields high confidentiality and integrity impact across a scope boundary (the captured JWT pivots into the Termix server), but AC:H and UI:R correctly acknowledge the attacker must already hold a privileged network position (rogue Wi-Fi, ARP/DNS spoofing, compromised upstream router, hostile VPN) and the victim must initiate a login or normal-use action. EPSS data was not provided in the input and the CVE is not on CISA KEV, with no POC identified at time of analysis, so this is best treated as a latent exposure for users on untrusted networks rather than evidence of mass exploitation. The most serious aggravator is the explicit statement that no patched version is available, meaning every current Termix Desktop install ≥1.7.0 carries the defect with no clean fix path.

An attacker on the same coffee-shop Wi-Fi as a Termix Desktop user runs a tool such as mitmproxy or bettercap with a self-signed certificate impersonating the user's configured Termix server URL; the Electron client accepts the forged certificate without warning. When the victim logs in or performs any subsequent action, the attacker captures credentials and the issued JWT/session token and replays them against the real Termix server to gain full management access to the victim's SSH endpoints. No public exploit identified at time of analysis, but the technique requires only off-the-shelf MITM tooling.