Termix EUVD-2026-86158

Requires an authenticated Termix user (versions 1.7.0 through 2.5.0) who has permission to deploy an SSH credential to a target host - the SSH key deployment flow is the exact feature abused. The attacker supplies a crafted public-key token whose keyPattern contains command substitution or quote-breaking syntax, which is interpolated into the double-quoted grep -F shell command executed on the selected remote host. Limiting factors: the attacker must already hold the privileged deploy capability (PR:H), a valid/selectable target host must be configured, and resulting command execution is bounded by the selected remote account's privileges. The separate ACME command-injection issue is explicitly out of scope for this CVE.

This is an authenticated command-injection flaw (CWE-78) in Termix's SSH key deployment flow. The vendor CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L yields 6.6 (Medium). Signals: attack vector is network (AV:N) with low complexity (AC:L), but it requires high privileges (PR:H) - an account that can deploy SSH credentials to a target host, which is normally an administrative/trusted operation. Scope is changed (S:C) because the injected commands execute on the selected remote target host, a security authority distinct from the Termix application itself. No EPSS score, KEV listing, or public POC is present in the supplied data, so exploitation status is: no public exploit identified at time of analysis. The most notable tension is impact scoring: the description states an attacker can 'execute commands with the selected remote account's privileges' - i.e. arbitrary command execution on the target - yet the vendor rated impact only C:L/I:L/A:L. Arbitrary command execution normally warrants High confidentiality/integrity/availability on the affected account; the Low ratings appear to understate real impact unless the deploy target account is heavily constrained. Net: this is a legitimate but not top-tier priority - the PR:H prerequisite (attacker must already be a privileged Termix user able to deploy credentials) and niche deployment footprint substantially limit real-world urgency, but where such users are semi-trusted or shared, the RCE-on-managed-hosts consequence is serious.

An authenticated Termix user with credential-deployment rights crafts an SSH public-key token containing command-substitution or quote-breaking shell syntax in the keyPattern value. When Termix runs its grep -F verification step, the payload interpolated into the double-quoted shell command executes on the selected target host with that remote account's privileges. No public exploit code is identified at time of analysis.