PT-2026-57816 · Vitec · Vitec Flamingo

Adam Outikni + 1 · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-60121

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vitec Flamingo version 4.12.2

Description An unauthenticated OS command injection exists in the 'admin/ajax/ping.php' endpoint. This issue stems from a double-evaluation flaw in shell argument handling where the host POST parameter is processed using escapeshellarg() but is subsequently retrieved and passed to a second shell exec() call without proper escaping. This allows remote attackers to execute arbitrary commands with root privileges via passwordless sudo.

Recommendations Update Vitec Flamingo version 4.12.2 to a patched version. As a temporary mitigation, restrict access to the 'admin/ajax/ping.php' endpoint or avoid using the host parameter until a fix is applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-60121

Affected Products

Vitec Flamingo

References · 8

• 🔥 https://damiri.fr/en/cve/CVE-2026-60121 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-60121 · Security Note
• https://twitter.com/OrizonCyber/status/2076675526786175136 · Twitter Post
• https://twitter.com/CVEnew/status/2076722751881032182 · Twitter Post
• https://vitec.com/solutions/iptv-distribution · Note
• https://vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-ping-php · Note
• https://twitter.com/infoflowcloud/status/2076723658844774889 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2076742265058308341 · Twitter Post