CVE-2022-31126

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

52.14% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-74

Published

2022-07-06

Updated

2025-04-23

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31126.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51227

References

• CVE Record
• NVD entry

Related

• CVE-2022-31125
• CVE-2022-31129
• CVE-2022-31110
• CVE-2022-3113
• CVE-2022-31108
• CVE-2022-31137