Roxy-WI EUVD-2026-36036

Exploitation requires (1) a valid Roxy-WI account at any privilege level including the lowest 'guest' role 4, since the only enforced control is @jwt_required(); (2) network reachability to the Roxy-WI web interface and its /agent/action/<action> POST endpoint; and (3) knowledge or guessing of a target server_ip value that Roxy-WI manages. What LIMITS exploitation: a valid Roxy-WI login is mandatory (no fully unauthenticated path), the deployment must actually be managing target servers via Roxy-WI's SSH agent with passwordless sudo (the default for Roxy-WI but a deployment-specific fact), and impact is confined to systemd actions on the roxy-wi-smon-agent unit specifically - not arbitrary command execution. No user interaction, no MFA prompt, and no group-membership relationship between the attacker's account and the target server are required.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H scores 8.5 and is consistent with the description: network-reachable endpoint, low complexity, only low privileges required (the guest role qualifies as PR:L), no user interaction, and a scope change because the vulnerable Roxy-WI authorization boundary is crossed to compromise downstream managed servers. Real-world risk is meaningful in environments that hand out guest accounts liberally or expose Roxy-WI beyond the operations team, since the agent controls monitoring on production HAProxy/Nginx fleets and an attacker can repeatedly toggle the unit to engineer outages. EPSS, KEV, and SSVC data were not provided in the input, so probabilistic exploitation likelihood and CISA prioritization status cannot be cited; no public exploit code was referenced either, so the practical risk is currently bounded by 'easy to weaponize but not yet weaponized publicly.' Note one tension worth verifying: the CVSS impact is C:N/I:L/A:H, but because the systemd action runs as root via passwordless sudo, a determined attacker could plausibly chain to a higher integrity or confidentiality impact than the vector suggests - defenders should not let the C:N rating downgrade prioritization.

An insider or attacker who has compromised any Roxy-WI account - even a guest with role 4 - authenticates to the web UI, obtains a JWT, and issues an HTTP POST to /agent/action/restart (or stop/start) with the server_ip form field set to a production HAProxy or Nginx host that the user has no legitimate authority over. Roxy-WI's backend opens its privileged SSH session to that target and runs systemctl as root, allowing the attacker to repeatedly stop the smon agent to blind monitoring or restart it to induce flapping and outages. No public exploit was referenced, but the attack is a single authenticated HTTP request and is trivially scriptable.