CVE-2026-65184 Details
Description
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
A command injection vulnerability has been identified in the Avocent ACS8000 console server's WebSocket terminal-bridge daemon, 'wsserver', running on loopback TCP port 2000. This vulnerability allows unauthenticated attackers to execute arbitrary commands as root. The issue arises because 'wsserver' constructs shell commands from client-supplied WebSocket fields and passes them to 'system()' and 'popen()'' without proper validation, quoting, or escaping. Additionally, the daemon's public-key session path lacks an appliance-session check, further exacerbating the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.runzero.com/advisories/avocent-acs8000-wsserver-cmdinj-cve-2026-65184 | runZero | AdvisoryVendor |
| https://www.runzero.com/blog/lights-out-exposed/ | runZero | BundleTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | runZero |
Affected Products
| Product | Versions |
|---|---|
| Avocent ACS8000 | 2.32.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | runZero |