Roxy-WI, a web interface for managing popular web and load balancer servers, contains an OS command injection flaw in the find-in-config endpoint. The vulnerability resides in the words parameter, which is concatenated into a shell command that is executed on a remote server via SSH. An attacker who has authenticated access can inject shell metacharacters to break out of the intended grep context and run arbitrary commands with sudo privileges, effectively compromising the target server and all services it hosts. The issue was identified as a CWE‑78 weakness.

All Roxy-WI installations running a version older than 8.2.6.4 are affected. The flaw exists in the /config/<service>/find‑in‑config endpoint across the Roxy‑WI product. No specific configurations beyond authentication are required—any authenticated user who can invoke the endpoint can exploit the vulnerability.

The vulnerability carries a CVSS score of 7.4, indicating a high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation under current attack‑surface observations, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local (authenticated) but results in remote code execution due to the privileged SSH session, presenting a serious risk if the administrator’s role is compromised or misused. Given the severity and the ease of exploitation once authentication is achieved, patching remains the most effective countermeasure.