CVE-2022-31137

CRITICALNuclei

Unauthenticated Remote Code Execution in Roxy-WI

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-31137 has a selected CVSS score of 10.0 (critical); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 21, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 22, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

roxy-wi

Browse hap-wi / roxy-wi
CVE List< 6.1.1.0affected

roxy-wi

Browse roxy-wi / roxy-wi
VulnCheckVersion data not supplied

Proofs of concept

1

Catalogued exploits

MetasploitRoxy-WI Prior to 6.1.1.0 Unauthenticated Command Injection RCEMetasploit exploitby Nuri Çilengir <nuri@prodaft.com>Not analyzed1 file

Ruby · linked to 2 vulnerabilities

Metasploit
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALRoxy-WI < 6.1.1.0 - Remote Code ExecutionCVSS 9.8

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Remediation

Users are advised to upgrade to latest version.

WeaknessesCWE-74
AuthorsDhiyaneshDK
Template tagscve2022cverceroxyroxy-wivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*
Shodan: http.html:"Roxy-WI"
Shodan: http.html:"roxy-wi"
FOFA: body="roxy-wi"
http://packetstormsecurity.com/files/167805/Roxy-WI-Remote-Command-Execution.html https://www.cve.org/CVERecord?id=CVE-2022-31137 https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9 https://nvd.nist.gov/vuln/detail/CVE-2022-31137

Source: ProjectDiscovery

References

6