CVE-2022-31126

critical · 10

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS

52.1%

EPSS (exploit prob.)

99th

EPSS percentile

2022-07-06

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Weaknesses

CWE-74

Affected products

Vendor	Product	Affected versions
roxy-wi	roxy-wi	< 6.1.1.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9
https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-31126