CVE-2026-60121

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://damiri.fr/en/cve/CVE-2026-60121	Third Party Advisory Exploit
https://www.vitec.com/solutions/iptv-distribution	Product
https://www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-ping-php	Third Party Advisory Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:vitec:flamingo:*:*:*:*:*:*:*:*

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Vitec Flamingo 4.12.2 contiene una vulnerabilidad de inyección de comandos del sistema operativo no autenticada en el endpoint admin/ajax/ping.php que permite a atacantes remotos ejecutar comandos arbitrarios explotando una falla de doble evaluación en el manejo de argumentos de shell. El endpoint aplica escapeshellarg() al parámetro POST ’host’ proporcionado por el usuario antes de pasarlo a un ’wrapper’ del sistema, pero el ’wrapper’ recupera el valor decodificado de ’argv’ y lo incorpora a una segunda llamada a shell_exec() sin escapar, permitiendo que los comandos inyectados se ejecuten con privilegios de root a través de ’sudo’ sin contraseña.

Information

Published : 2026-07-13 14:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-60121

Mitre link : CVE-2026-60121

CVE.ORG link : CVE-2026-60121

JSON object : View

Products Affected

vitec

flamingo

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-60121", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60121", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-13T14:02:10.325685Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "VITEC", "product": "Flamingo", "versions": [{"status": "affected", "version": "4.12.2", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2026-07-13T14:16:32.067", "references": [{"url": "https://damiri.fr/en/cve/CVE-2026-60121", "tags": ["Third Party Advisory", "Exploit"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vitec.com/solutions/iptv-distribution", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-ping-php", "tags": ["Third Party Advisory", "Exploit"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo."}, {"lang": "es", "value": "Vitec Flamingo 4.12.2 contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo no autenticada en el endpoint admin/ajax/ping.php que permite a atacantes remotos ejecutar comandos arbitrarios explotando una falla de doble evaluaci\u00f3n en el manejo de argumentos de shell. El endpoint aplica escapeshellarg() al par\u00e1metro POST \u2019host\u2019 proporcionado por el usuario antes de pasarlo a un \u2019wrapper\u2019 del sistema, pero el \u2019wrapper\u2019 recupera el valor decodificado de \u2019argv\u2019 y lo incorpora a una segunda llamada a shell_exec() sin escapar, permitiendo que los comandos inyectados se ejecuten con privilegios de root a trav\u00e9s de \u2019sudo\u2019 sin contrase\u00f1a."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vitec:flamingo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1EBCF49-7D07-4ED2-9677-456783507F49", "versionEndIncluding": "4.12.2"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}