The vulnerability arises when Roxy-WI, if LDAP authentication is activated, concatenates a user-supplied login string directly into an LDAP search filter without escaping special characters. An unauthenticated attacker can inject LDAP meta-characters into the username field, causing the search operation to return an unintended directory entry and thereby bypass authentication. As a result, the attacker gains authenticated access to the application’s interface, potentially with full administrative privileges. This flaw is classified as CWE-287 and is reflected in a CVSS score of 7.7.

The affected product is Roxy-WI, managed by the roxy-wi vendor. The issue is present in all versions up to and including 8.2.8.2. No official patch or workaround has been released by the vendor at the time of publication, and the vulnerability is not listed in the CISA KEV catalog.

With an unauthenticated attack vector and a CVSS score of 7.7, the technical severity is high. The EPSS score of 0.00142 (below 1%) indicates a very low probability of real-world exploitation, but the vulnerability’s lack of a patch and its straightforward injection mechanism still allow skilled attackers to use it. Since it is not listed in CISA KEV, no widespread active exploits have been observed, yet the potential for targeted attacks exists. Protective action remains necessary through disabling LDAP authentication, applying a local code fix, or restricting network access to the Roxy-WI instance.