CVE-2022-31126

CRITICALNuclei

Unauthenticated Remote Code Execution in Roxy-wi

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-31126 has a selected CVSS score of 10.0 (critical); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 13, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

roxy-wi

Browse hap-wi / roxy-wi
CVE List< 6.1.1.0affected

roxy-wi

Browse roxy-wi / roxy-wi
VulnCheckVersion data not supplied

Proofs of concept

1

Catalogued exploits

ExploitDBRoxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)ExploitDB exploitby Nuri ÇilengirNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALRoxy-WI - Remote Code ExecutionCVSS 9.8

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the ssh_command function without processing the inputs received from the user in the /app/funct.py file.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Remediation

Users are advised to upgrade to latest version.

WeaknessesCWE-74
Authorsritikchaddha
Template tagscve2022cverceroxyroxy-wivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*
Shodan: html:"Roxy-WI"
FOFA: body="roxy-wi"
https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137/ https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9 https://nvd.nist.gov/vuln/detail/CVE-2022-31126

Source: ProjectDiscovery

References

1