CVE-2026-65184: Avocent ACS8000 wsserver command injection
The root-privileged wsserver terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system() and popen() without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated appliance session?
No. The public-key session path performs no appliance-session check, and the vulnerability is rated with no privileges and no user interaction required.
What access does an attacker need to attempt exploitation?
An attacker needs network access to the affected device's wsserver service. The attack vector is network-based and the complexity is rated low.
What is the likely impact if exploitation succeeds?
Because wsserver runs with root privileges and passes attacker-controlled command content to system() and popen(), successful exploitation can result in high-impact compromise of confidentiality, integrity, and availability.