PT-2026-34836 · Roxy-Wi · Roxy-Wi

Firebasky · Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-33208

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.4

Description The '/config//find-in-config' endpoint fails to sanitize the words parameter before embedding it into a shell command string executed on a remote managed server via SSH. An authenticated attacker can inject shell metacharacters to bypass the intended grep command and execute arbitrary OS commands with sudo privileges, leading to Remote Code Execution (RCE), which is the ability to execute any command on a target machine remotely.

Recommendations Update to version 8.2.6.4.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-33208

Affected Products

Roxy-Wi

References · 4

• 🔥 https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7m2h-gmvj-cjx2 · Exploit
• https://github.com/roxy-wi/roxy-wi/commit/02f147d567a3cc8cf61a4b58ea4c2b7866a544de · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33208 · Security Note
• https://twitter.com/CVEnew/status/2048099334487413062 · Twitter Post