Avocent ACS8000 EUVD-2026-109933

Exploitation requires network reachability to the root-privileged wsserver terminal-bridge daemon's WebSocket interface on an Avocent ACS8000. The specific weakness is that the daemon's public-key session path performs no appliance-session check, so an attacker can reach the vulnerable command-construction path without passing an appliance authentication gate (consistent with PR:N), and the injected shell metacharacters in client-supplied WebSocket fields flow into system()/popen() unquoted and unvalidated. The practical limiting factor is exposure of the wsserver WebSocket service: appliances whose management/WebSocket interface is not reachable from the attacker's network are not exploitable remotely. No user interaction is required. No vendor mitigation or fixed version is stated in the available input.

All available signals point to genuine, high-priority risk. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, and this is consistent with the description: a root-privileged daemon passing client-supplied WebSocket fields to system()/popen() with no quoting, escaping, or validation (CWE-78), where the public-key session path performs no appliance-session check - corroborating PR:N (no authentication gate). The vuln.today decision label is act_now, which signals urgency and should drive remediation timing. No EPSS score, CISA KEV entry, or confirmed public exploit code was provided in the input, so breadth of real-world exploitation cannot be quantified from this data; the referenced material is a runZero advisory and blog ('Lights Out Exposed'), not verified exploit code. The main contrast is between the very high intrinsic severity and act_now priority on one side and the absence of EPSS/KEV exploitation telemetry on the other - treat this as a top-priority patch driven by the act_now decision and trivial exploitability, not by confirmed in-the-wild activity, which is simply unverified here rather than ruled out.

An attacker with network reachability to an ACS8000's wsserver terminal-bridge daemon opens a WebSocket connection and, via the public-key session path that skips the appliance-session check, submits WebSocket fields containing shell metacharacters. Because the daemon concatenates these fields into a shell string handed to system()/popen() without sanitization while running as root, the injected commands execute with root privileges. No confirmed public exploit code was identified in the provided data; the referenced material is a researcher advisory and blog, not verified working exploit code.