CVE-2022-31161: Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 28.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-15 · updated 2026-06-17
Weakness: CWE-77

Description

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.

Affected products

roxy-wi: before 6.1.1.0 — fixed in 6.1.1.0

How to fix

Upgrade to a fixed version: roxy-wi 6.1.1.0. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html
https://github.com/hap-wi/roxy-wi/releases/tag/v6.1.1.0
https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483
http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html
https://github.com/hap-wi/roxy-wi/releases/tag/v6.1.1.0
https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483

Get alerted when CVE-2022-31161 or the next vulnerability affects your stack