Technical impact
The vulnerability resides in Vitec Flamingo 4.12.2, specifically the admin/ajax/ping.php endpoint. An unauthenticated attacker can supply a host value that is passed through escapeshellarg() and then through a system wrapper that decodes the argument and injects it into a second shell_exec() call. This double‑evaluation flaw enables the attacker to run arbitrary shell commands with root privileges by abusing passwordless sudo. The flaw is a classic OS command injection, categorized as CWE‑78. As a result, the attacker can gain full control over the affected device, including reading, mechanisms.
Affected Systems
The affected product is Vitec Flamingo version 4.12.2. No other specific versions are listed in the CVE report, but the vulnerability only applies to this exact release unless later releases are unpatched. Administrators who manage firewalls, set‑top boxes, or other Vitec platforms should verify that they are not running this version.
Risk and Exploitability
The CVSS base score of 9.3 reflects a high severity, with an exploitable vector that does not require authentication and provides full root access via a remote web request. The EPSS score of 1% indicates a lack of necessary credentials and the presence of passwordless sudo mean that any attacker who can reach the ping.php endpoint can deploy the exploit quickly. The vulnerability is not currently listed in the CISA KEV catalog, yet the impact warrants immediate attention. Attackers can trigger the vulnerability by sending a crafted POST request to the ping.php endpoint, exploiting the double‑evaluation flaw without any pre‑existing access.
