CVE-2022-31137

CVE-2022-31137 is a critical-severity vulnerability in Roxy-wi with a CVSS 3.x base score of 10.0. Its EPSS exploit-prediction score of 91% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-78.

Key facts

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Frequently asked questions

What is CVE-2022-31137?
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
How severe is CVE-2022-31137?
CVE-2022-31137 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-31137 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 91% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-31137?
CVE-2022-31137 affects Roxy-wi. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-31137?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2022-31137 published?
CVE-2022-31137 was published on 2022-07-08 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Roxy-wi

All CVEs affecting Roxy-wi →

Other CWE-78 (OS Command Injection) vulnerabilities

Browse all CWE-78 (OS Command Injection) vulnerabilities →