← Vulnerability feed

Vulnerability record · CVE-2022-31126 · published 6 July 2022

CVE-2022-31126: Roxy-wi unauthenticated remote code execution via options.py injection

Roxy Wi · Roxy Wi

Roxy-wi, an open source web interface for managing HAProxy, Nginx, Apache and Keepalived, contains an injection flaw (CWE-74) in /app/options.py. A remote, unauthenticated attacker can achieve code execution by sending a specially crafted HTTP request. All versions before 6.1.1.0 are affected, and no workarounds exist.

9.8 CVSS 3.1 Critical EPSS 53% · top 1.1% CWE-74 · Injection
9.8CVSS 3.1 base score, v2 7.5
53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and full confidentiality, integrity and availability impact, plus very high EPSS.

What it is

Roxy-wi, an open source web interface for managing HAProxy, Nginx, Apache and Keepalived, contains an injection flaw (CWE-74) in /app/options.py. A remote, unauthenticated attacker can achieve code execution by sending a specially crafted HTTP request. All versions before 6.1.1.0 are affected, and no workarounds exist.

Impact

An attacker gains remote code execution on the Roxy-wi host with no credentials required, giving full compromise of the management server and any managed infrastructure it controls.

Attack surface

Reachable over the network via HTTP requests to /app/options.py; the CVSS vector (AV:N/PR:N/UI:N) confirms no authentication and no user interaction are needed.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is 0.52137 (99th percentile), indicating a high modeled likelihood of exploitation activity.

What to do

  • Upgrade Roxy-wi to version 6.1.1.0 or later immediately.
  • Restrict network access to the Roxy-wi web interface to trusted management networks or VPN only.
  • Place the interface behind an authenticating reverse proxy or WAF and block direct access to /app/options.py from untrusted sources.
  • Monitor the host for unexpected processes or outbound connections, since no workaround exists and compromise requires host rebuild.

Detection

  • Inspect web server and application logs for anomalous or malformed requests to /app/options.py.
  • Alert on unexpected child processes spawned by the Roxy-wi web service (e.g., shells, curl, wget).
  • Monitor for outbound connections from the Roxy-wi host to unfamiliar external addresses.
  • Review file integrity on the Roxy-wi installation directory for unauthorized modifications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9 Third Party Advisory
https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9 Third Party Advisory

Track CVE-2022-31126 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-31161Roxy-wi command injection vulnerabilityRoxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via t…EPSS 28%9.8CVE-2022-31137Roxy-WI unauthenticated OS command injection in options.pyRoxy-WI versions before 6.1.1.0 pass user-supplied input into the subprocess_execute function in /app/options.py without sanitisation, allowing OS co…EPSS 91%analysed9.8CVE-2022-31125Roxy-wi improper authentication vulnerabilityRoxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unaut…EPSS 20%9.8CVE-2021-38167Roxy-wi sql injection vulnerabilityRoxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can extract a valid uuid to bypass authentication.EPSS 1.3%8.9CVE-2026-33076Roxy-wi path traversal vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface p…EPSS 1.0%8.9CVE-2026-33078Roxy-wi sql injection vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability i…EPSS 0.52%8.8CVE-2026-27811Roxy-wi command injection vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability ex…EPSS 3.0%8.8CVE-2024-43804Roxy-wi os command injection vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2022-31126), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.