Roxy-WI EUVD-2026-25376

No special conditions required for exploitation against default Roxy-WI deployments. The CVSS:4.0 vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation with low complexity against network-accessible instances. The vulnerability does not require the haproxy_section_save endpoint to be explicitly enabled - it is part of the standard Roxy-WI functionality. Exploitation is limited only by network reachability: instances deployed behind firewall rules restricting access to internal networks, VPN-only access, or IP allowlists are not exploitable from the internet. The vulnerability affects file read operations, so impact is limited to files readable by the Roxy-WI application process user (typically a web service account), not requiring root privileges. Organizations that never exposed the Roxy-WI management interface to untrusted networks face negligible risk regardless of version.

This vulnerability represents high real-world risk for internet-exposed Roxy-WI installations. The CVSS:4.0 score of 7.7 with vector AV:N/AC:L/PR:N indicates remote unauthenticated exploitation with low complexity - no special conditions required. The E:P (Proof-of-Concept) metric confirms exploit code exists, lowering the skill barrier for attackers. Given Roxy-WI's purpose as a centralized management interface for critical infrastructure components (load balancers, reverse proxies), successful file read can expose credentials for multiple backend systems, SSL private keys, API tokens, and database connection strings. The VC:H (High Confidentiality) rating accurately reflects this impact. However, EPSS data is not provided to confirm observed exploitation rates. The vulnerability requires public exposure of the management interface - organizations following best practices of restricting admin interfaces to internal networks or VPN-only access significantly reduce exploitability. This is a priority patch for any Roxy-WI instance accessible from untrusted networks, but lower urgency for properly segmented deployments.

An unauthenticated attacker scans for internet-exposed Roxy-WI instances on common ports (typically 8080 or 443) and identifies the management interface. The attacker sends a crafted HTTP request to the haproxy_section_save endpoint with the oldconfig parameter set to '../../../../etc/shadow' or '../../../../root/.ssh/id_rsa'. Due to insufficient input validation, Roxy-WI reads and returns the contents of the requested file. With proof-of-concept exploit code publicly available (E:P), attackers can automate discovery and exploitation to harvest credentials, SSL certificates, and configuration data across vulnerable instances, pivoting to managed infrastructure.