A critical command injection vulnerability in Roxy-WI versions prior to 8.2.6.3 allows authenticated attackers to gain full system control of the hosting server.

The application is vulnerable to OS command injection due to improper neutralization of user input in the /config/compare/<service>/<server_ip>/show endpoint. Specifically, input is directly formatted into a template string within app/modules/config/config.py at line 362, which is subsequently executed by the system.

Successful exploitation of this flaw grants an authenticated attacker the ability to execute arbitrary commands with the privileges of the Roxy-WI process. This leads to a complete compromise of the application host, potential lateral movement within the network, and full loss of confidentiality, integrity, and availability for the managed server configurations. The CVSS score of 8.8 reflects the high severity of this risk, as it allows for total system impact once initial access is obtained.

Immediate Action: Upgrade the Roxy-WI installation to version 8.2.6.3 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web access logs for suspicious requests targeting the /config/compare/ path and monitor system process logs for unexpected shell execution commands.

Compensating Controls: Implement strict access control lists and restrict network access to the Roxy-WI management interface to trusted administrative IP addresses only.

Public Exploit Available: Unknown.

Given the severity of this command injection flaw and the potential for full host compromise, administrators should prioritize patching immediately. Ensure that the update to version 8.2.6.3 is applied across all instances of Roxy-WI to mitigate the risk of unauthorized system-level command execution.