CVE-2026-65184

Published: Oct 26, 2026Modified: Oct 26, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 44488dab-36db-4358-99f9-bc116477f914 (Secondary)

Description

The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://www.runzero.com/advisories/avocent-acs8000-wsserver-cmdinj-cve-2026-65184

Source: 44488dab-36db-4358-99f9-bc116477f914

https://www.runzero.com/blog/lights-out-exposed/

Source: 44488dab-36db-4358-99f9-bc116477f914

Timeline

No history available yet.