Critical · published July 8, 2022
CVSS calls it critical at 10.0. It sits in the 99.8th percentile for exploit probability.
🔥 A remote code execution flaw in Roxy-WI means an attacker could run any command they like, and they don’t even need a password! This is like leaving the door wide open to your server room with a sign that says, 'Come on in, the door’s unlocked!'—inviting trouble without a second thought. An attacker could exploit this vulnerability to take complete control of your server, potentially stealing sensitive data, modifying configurations, or launching further attacks. The consequences could be absolutely devastating, with your entire system at risk.
This is like leaving the door wide open to your server room with a sign that says, 'Come on in, the door’s unlocked!'—inviting trouble without a second thought. The issue lies in the 'subprocess_execute' function in /app/options.py, which fails to properly validate user inputs before executing system commands. This allows unauthenticated users to run arbitrary commands on the server.
An attacker could exploit this vulnerability to take complete control of your server, potentially stealing sensitive data, modifying configurations, or launching further attacks. The consequences could be absolutely devastating, with your entire system at risk. Upgrade Roxy-WI to version 6.1.1.0 or later immediately; there are no known workarounds for this vulnerability. Ensure all instances running prior versions are patched as soon as possible. You’ve got this! By following these steps, you’ll turn this vulnerability into a point of strength for your systems. 🛡️