title: Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload
description: Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.
problem types: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
affected:
{
vendor: hap-wi
product: roxy-wi
versions:
version: < 6.1.1.0, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 10
baseSeverity: CRITICAL
]