Compliance Impact

CVE-2026-45564 allows an authenticated user with low privileges to execute arbitrary commands on the affected system, leading to high confidentiality, integrity, and availability impacts. Such a compromise can result in unauthorized access to sensitive data, data modification, or service disruption.

These impacts can negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data, maintaining data integrity, and ensuring system availability.

Specifically, a successful exploit could lead to breaches of confidentiality and integrity of protected data, potentially resulting in regulatory violations and associated penalties.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-45564 is a high-severity authenticated remote code execution (RCE) vulnerability in Roxy-WI versions 8.2.6.4 and earlier.

The vulnerability exists in the `/config/versions/<service>/<server_ip>/<configver>/save` endpoint, where the `configver` URL parameter is directly inserted into a shell command without proper validation or sanitization.

An authenticated user with a role level of 3 or lower can exploit this by injecting shell metacharacters into the `configver` parameter, leading to arbitrary command execution via the `os.system` call.

This happens because the parameter is not properly validated or escaped, and a previous patch failed to fix this issue.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation allows an attacker to execute arbitrary commands on the server as the web server user.

With default sudo configurations permitting passwordless `chown`, the attacker can escalate privileges laterally.

The impact includes high loss of confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious or unexpected HTTP POST requests to the endpoint /config/versions/<service>/<server_ip>/<configver>/save, especially those containing shell metacharacters in the configver parameter.

Commands to detect potential exploitation attempts include inspecting web server logs for POST requests to the vulnerable endpoint with unusual characters, for example using grep:

• grep -E 'POST /config/versions/.+/.+/.+/save' /var/log/nginx/access.log | grep -E '[;&|`$]'

Additionally, monitoring for unexpected shell command executions or unusual process activity related to dos2unix or os.system calls may help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoint to trusted users only, especially limiting authenticated users with role level 3 or lower.

Avoid using the vulnerable versions of Roxy-WI (8.2.6.4 and earlier) if possible, and monitor for any updates or patches that replace os.system calls with safer alternatives like subprocess.run.

As no public patches are available at the time of publication, consider implementing network-level controls such as firewall rules to block access to the vulnerable endpoint or disabling the affected functionality temporarily.

Review sudo configurations to prevent passwordless privilege escalation that could be leveraged after initial exploitation.

Useful 0 Not Useful 0