Vulnerability Description
Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vitec | Flamingo | <= 4.12.2 |
Related Weaknesses (CWE)
References
- https://damiri.fr/en/cve/CVE-2026-60121Third Party AdvisoryExploit
- https://www.vitec.com/solutions/iptv-distributionProduct
- https://www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-iThird Party AdvisoryExploit
FAQ
What is CVE-2026-60121?
CVE-2026-60121 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a doub...
How severe is CVE-2026-60121?
CVE-2026-60121 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-60121?
Check the references section above for vendor advisories and patch information. Affected products include: Vitec Flamingo.