CVE-2022-31137 Unauthenticated Remote Code Execution in Roxy-WI

Critical 10.0 Published 8 Jul 2022 Updated 22 Apr 2025

Unauthenticated attackers can execute arbitrary system commands on Roxy-WI servers due to improper input handling in the options module.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-31137?

CVE-2022-31137 is a critical command injection vulnerability in hap-wi roxy-wi, published on 8 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-78

Which versions are affected by CVE-2022-31137?

It affects 1 product.

Products include Roxy-Wi Roxy-Wi.

How do I fix CVE-2022-31137?

No fix has been published for CVE-2022-31137 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-31137 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31137 exists.

Public exploit code: 1 Metasploit module and 1 Nuclei template.

Sources

Also known as GHSA-53r2-mq99-f532.