The vulnerability stems from missing role and group checks on the POST /smon/agent/action/<action> endpoint in Roxy‑WI (CWE‑862, CWE‑863). Any authenticated user, including those with the guest role (role 4), can post a request to start, stop, or restart the roxy‑wi‑smon-agent systemd unit on any server that the user can name. The agent then executes the systemd action using Roxy‑WI’s SSH credentials with passwordless sudo, meaning the commands run as root on the target host. This allows an attacker to cause service disruption on load balancers or monitoring agents, effectively denying service to dependent services or the end users.

This flaw affects Roxy‑WI version 8.2.6.4 and earlier. Roxy‑WI is a web interface used to manage Haproxy, Nginx, Apache and Keepalived servers.

The vulnerability involves missing role checks and group checks (CWE‑862, CWE‑863). The CVSS score of 8.5 indicates high severity. EPSS is not available, but the CVE is not currently listed in the CISA KEV catalogue. The exploit path requires only an authenticated guest session; no additional credentials are needed beyond the standard login. Because the vulnerable action is exposed over HTTP and is executed with root privileges on the target host via SSH, an attacker can immediately disrupt services without further reconnaissance. The lack of an official patch at publication time further increases the urgency of mitigating the issue.