SB2026042074 - Multiple vulnerabilities in Roxy-WI

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026042074

SB2026042074 - Multiple vulnerabilities in Roxy-WI

Published: April 20, 2026 Updated: April 23, 2026

Security Bulletin ID SB2026042074
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 33% Low 17%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) LDAP injection (CVE-ID: CVE-2026-33432)

CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to LDAP injection in app/modules/roxywi/auth.py when processing login requests with a user-supplied username in an LDAP search filter. A remote attacker can send a specially crafted login request to bypass authentication.

Only instances with LDAP authentication enabled are vulnerable. If the LDAP server allows anonymous binds or unauthenticated simple binds, exploitation may succeed without a password.


2) Path traversal (CVE-ID: CVE-2026-33431)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to path traversal in the POST /config//show API endpoint when processing the user-supplied configver parameter. A remote user can send a specially crafted request containing ../ sequences to disclose sensitive information.

The issue affects authenticated users regardless of their assigned role, and exposed files may include the application configuration and SSH private keys accessible to the web application process.


3) Command injection (CVE-ID: CVE-2026-33208)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary os commands.

The vulnerability exists due to command injection in the /config//find-in-config endpoint when processing the user-supplied words parameter and embedding it into a shell command executed over ssh. A remote user can send a specially crafted post request to execute arbitrary os commands.

Successful exploitation occurs on the remote managed server and the injected commands are executed with sudo privileges.


4) Path traversal (CVE-ID: CVE-2026-33077)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the haproxy_section_save interface when handling crafted requests containing a user-controlled file path in the oldconfig parameter. A remote attacker can send a specially crafted request to disclose sensitive information.

The supplied file path is opened by the rewrite_section function, and the file contents may be exposed through subsequent server operations.


5) Path traversal (CVE-ID: CVE-2026-33076)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to path traversal in the haproxy_section_save interface when handling a crafted server_ip path parameter. A remote attacker can send a specially crafted request to execute arbitrary code.

The issue allows writing attacker-controlled content into scheduled task files such as files under /etc/cron.d.


6) SQL injection (CVE-ID: CVE-2026-33078)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in the haproxy_section_save endpoint when handling a crafted server_ip parameter from the URL path. A remote attacker can send a specially crafted request to execute arbitrary SQL commands.

The issue may allow disclosure of sensitive database contents, and in certain database configurations may enable further impacts.


Remediation

Install update from vendor's website.

References