The vulnerability is a command injection in the /config/compare/<service>/<server_ip>/show endpoint of Roxy‑WI, allowing an authenticated user to execute arbitrary system commands on the host. This leads to complete compromise of the underlying server, granting attackers full control over the system. The flaw is due to direct formatting of user input into a template string, which is then executed. The weakness corresponds to CWE‑77 (Command Injection) and CWE‑78 (OS Command Injection).

Roxy‑WI, the web interface for managing HAProxy, Nginx, Apache and Keepalived servers, is affected in all releases prior to version 8.2.6.3. Users running any earlier version of the software are vulnerable.

The CVSS base score is 8.8, indicating high severity. The EPSS score is below 1%, suggesting a relatively low probability of exploitation at the current time, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires valid user credentials to access the application and the /config/compare endpoint, so attackers must first authenticate. Once authenticated, they can supply a specially crafted diff parameter to execute arbitrary commands. Because the flaw resides in the server side code, it can affect the entire host, providing a high impact if exploited.