Termix EUVD-2026-86161

Requires an authenticated Termix administrator account (PR:H) with access to the ACME/SSL certificate feature: the attacker must reach PATCH /users/acme-ssl-settings to store attacker-controlled domain and email values and POST /users/acme-ssl-request to trigger certbot execution. Affected versions are 2.4.1 through 2.5.0 only (fixed in 2.5.1). Both HTTP-webroot and DNS-Cloudflare challenge modes are vulnerable, so no specific challenge configuration limits exploitation. The primary limiting factor is the admin privilege requirement - this is not remotely reachable pre-authentication, and there is no known public exploit - so realistic risk is confined to environments where the admin role is shared, delegated to lower-trust operators, or exposed to credential theft.

This is a genuine command-injection RCE (CWE-78) but its real-world priority is materially constrained by the privilege requirement. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H scores 9.1, driven by full C/I/A impact plus a scope change; however PR:H means the attacker must already hold Termix administrator rights, and the two-step vector (PATCH /users/acme-ssl-settings to store the payload, then POST /users/acme-ssl-request to trigger it) is a privileged self-service ACME/SSL configuration flow, not an anonymous endpoint. This is effectively an authenticated-admin-to-OS-RCE escalation on the host running the Termix backend. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis' - the 9.1 reflects worst-case technical impact rather than mass-exploitability. The source-code diff (execSync of /bin/sh -c with values only double-quoted, fixed by switching to execFileSync with argv arrays) unambiguously confirms the root cause and the fix, so the vulnerability itself is not in doubt. One scoring note to verify: NVD assigns S:C, but since the injection yields code execution as the same backend process on the same host, S:U is equally defensible, which would lower the base score to roughly 7.2 - this is a scope-interpretation difference, not a factual dispute. Overall: real and serious for anyone who considers their admin account a trust boundary (or uses shared/federated admin access), but low mass-exploitation urgency given the admin prerequisite and niche product footprint.

An authenticated Termix administrator (or an attacker who has phished/stolen admin credentials, or a lower-trust operator in a multi-admin deployment) sets the ACME domain or email field to a value containing shell metacharacters via PATCH /users/acme-ssl-settings, then invokes POST /users/acme-ssl-request; the certbot command built by execSync passes the payload to /bin/sh -c, executing arbitrary commands as the Termix backend process. No user interaction and no public PoC are known, and both HTTP-webroot and DNS-Cloudflare challenge modes are exploitable, so the attacker immediately reaches the databases, process secrets, and stored SSH credentials Termix manages.