CVE-2026-60121 Details
Description
Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.
A critical unauthenticated OS command injection vulnerability exists in Vitec Flamingo version 4.12.2, specifically within the admin/ajax/ping.php endpoint. This vulnerability allows remote attackers to execute arbitrary commands with root privileges via passwordless sudo. The issue arises from a double-evaluation flaw in how shell arguments are handled. Although the endpoint initially sanitizes the user-supplied host parameter using escapeshellarg(), the subsequent execution step retrieves the decoded value without proper escaping, enabling command injection exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://damiri.fr/en/cve/CVE-2026-60121 | [email protected] | Third Party AdvisoryExploit |
| https://www.vitec.com/solutions/iptv-distribution | [email protected] | Product |
| https://www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-ping-php | [email protected] | Third Party AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vitec flamingo | <= 4.12.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 14, 2026 | Initial Analysis | [email protected] |
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |