Which versions of Vitec Flamingo are affected by CVE-2026-61498?

Vitec Flamingo 4.12.2 contains a critical remote code execution vulnerability in its graph-generation API endpoint that allows unauthenticated attackers to execute arbitrary commands as the root…

Is there a public PoC exploit available for CVE-2026-61498?

Yes, a public proof-of-concept exploit is available for CVE-2026-61498. Prioritise patching immediately. EPSS: 2.2%.

How to fix or mitigate CVE-2026-61498?

Within 24 hours, conduct an asset inventory to identify all systems running Vitec Flamingo 4.12.2 and assess network exposure; physically isolate or block internet access to affected systems if feasible. Within 7 days, implement emergency compensating controls including Web Application Firewall rules to block requests to the admin/ajax/gen_graphs.php endpoint, enforce network segmentation to restrict administrative access, and remove or restrict passwordless sudo privileges from the web server process. Within 30 days, establish direct communication with Vitec regarding patch availability timeline, and if no patch is released, begin evaluating alternative solutions for graph-generation functionality or initiate a replacement project for Vitec Flamingo.

Vitec Flamingo CVE-2026-61498

Q: What is the CVSS score of CVE-2026-61498?

CVE-2026-61498 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.2%.

CRITICAL

OS Command Injection (CWE-78)

2026-07-13 VulnCheck

PHP Command Injection Flamingo Vitec

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated HTTP GET with no user interaction gives AV:N/AC:L/PR:N/UI:N, and root-level command execution yields full C:H/I:H/A:H; scope unchanged as impact stays within the appliance OS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 14:00 vuln.today

CVE Published

Jul 13, 2026 - 13:12 cve.org

CRITICAL 9.3

DescriptionCVE.org

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access.

Articles & Coverage 1

News Critical RCE in Vitec Flamingo 4.12.2 - CVE-2026-61498 Jul 13, 2026

AnalysisAI

Remote OS command execution in Vitec Flamingo 4.12.2 lets unauthenticated attackers run arbitrary commands as root through the admin/ajax/gen_graphs.php graph-generation endpoint. The start, end, key, and format GET parameters are passed unsanitized into a PHP passthru() shell call, and because the web server runs with passwordless sudo the impact escalates to full root compromise. Publicly available exploit code exists (VulnCheck), though there is no CISA KEV listing, so this is a high-priority, easily weaponizable flaw.

Technical ContextAI

Vitec Flamingo is an IPTV/video distribution appliance whose administrative web interface is built in PHP (confirmed by the CPE cpe:2.3:a:vitec:flamingo and the PHP tag). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerable script admin/ajax/gen_graphs.php constructs a shell command line to generate graphs and feeds attacker-controlled HTTP GET parameters directly to PHP's passthru() function, which executes its argument via the system shell (/bin/sh). Any shell metacharacters (;, |, &&, backticks, $()) in the start, end, key, or format parameters break out of the intended command and are executed. Because the endpoint sits under admin/ajax but enforces no authentication, and the web/PHP process holds passwordless sudo, injected commands run with root privileges.

RemediationAI

No vendor-released fixed version was identified at time of analysis, so upgrade guidance cannot cite an exact patch - monitor Vitec and the VulnCheck advisory (https://www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-gen-graphs-php) for a patched release and apply it as soon as available. As immediate compensating controls: block or restrict network access to the admin/ajax/gen_graphs.php endpoint and the entire administrative interface using firewall rules or a reverse-proxy allowlist so only trusted management hosts can reach it (trade-off: legitimate remote admins must connect via VPN/jump host); place the appliance on an isolated management VLAN rather than exposing it to the internet or general LAN; and if a WAF is present, add rules rejecting shell metacharacters (;, |, &, backticks, $()) in the start, end, key, and format parameters (trade-off: pattern-based filtering can be bypassed and may break legitimate graph queries). Critically, remove the passwordless sudo grant from the web server account so that even a successful injection runs with limited privileges rather than root (trade-off: verify no legitimate appliance function depends on that sudo access before changing it).