S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated May 20, 2025

CVE-2022-31137 Scanner

Targets the subprocess_execute function in Roxy-WI, allowing unauthenticated attackers to execute arbitrary system commands on the server.

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, subdomain, ipv4
CostFree
2.9k
Times Used
continuous scan runs
5.9k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2022-31137
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
roxy-wiby hap-wi
< 6.1.1.0
Updated Aug 22, 2026View on NVD →
Detail

Roxy-WI is a web-based interface used by system administrators to manage HAProxy, Nginx, and Keepalived servers. It simplifies load balancing and high availability configurations in data centers and critical infrastructure across industries like telecom, finance, and healthcare. As an open-source tool, it offers cost-effective server management but requires vigilant security updates.

CVE-2022-31137 is a critical Remote Code Execution (RCE) vulnerability in Roxy-WI. It arises from insufficient input validation in the subprocess_execute function, which handles user-supplied commands. This flaw allows attackers to inject malicious commands without proper sanitization, leading to arbitrary code execution.

The vulnerability specifically affects the subprocess_execute function in the backend code, where parameters are not properly filtered. An attacker can exploit this by sending crafted HTTP requests to the vulnerable endpoint, bypassing authentication and executing system-level commands on the host server.

If exploited, an attacker gains full control over the Roxy-WI server, enabling data theft, malware installation, or lateral movement within the network. Given the CVSS score of 9.8, this poses a severe risk to organizations relying on Roxy-WI for critical infrastructure management.

Solution Advice
  • Upgrade Roxy-WI to the latest patched version immediately to fix the input validation flaw.
  • Restrict network access to Roxy-WI using firewalls or VPNs, allowing only trusted IPs.
  • Implement strict input validation and sanitization for all user-supplied data, especially in command execution functions.
  • Disable unnecessary features or modules that expose the subprocess_execute function if not required.
  • Enable detailed logging and monitor for unusual command execution patterns or unauthorized access attempts.
  • Apply the principle of least privilege to the Roxy-WI service account, limiting its system permissions.
  • Conduct regular security audits and penetration testing to identify similar vulnerabilities in the deployment.
  • Use a Web Application Firewall (WAF) to block malicious payloads targeting the vulnerable endpoint.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Roxy-WI RCE Scanner | S4E Free Check