A command injection flaw exists in the /config/compare<service>/server_ip/show endpoint of Roxy‑WI. The flaw is caused by directly formatting a user supplied diff parameter into a template string that is later executed on the host. Because the application runs with the privileges of the web server, an attacker who can authenticate to the interface can supply malicious input to run arbitrary system commands, achieving full compromise of the underlying operating system. This vulnerability corresponds to CWE‑77 and CWE‑78.

All released versions of Roxy‑WI prior to 8.2.6.3 are affected. Users of the web interface that manages HAProxy, Nginx, Apache, and Keepalived servers should verify that they are not running a vulnerable build.

The CVSS base score is 8.8, indicating a high severity level. The EPSS score of 2% suggests a moderate probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated to the application; however, once authenticated they can deliver a specially crafted diff value to trigger arbitrary command execution. Because the flaw is on the server side, a single successful exploitation can lead to complete system compromise.