Live › vulnerability › CVE-2026-65184
Go to dashboardUnauthenticated command injection as root in the wsserver terminal-bridge daemon of Vertiv Avocent ACS8000 console servers (firmware <= 2.32.4). Apache proxies /termviewer to wsserver (loopback TCP 2000) with no authentication, and client WebSocket fields reach system()/popen() unquoted. Found by runZero (HD Moore) from firmware analysis; not yet confirmed on a live device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Teams running Vertiv Avocent ACS8000 or ACS800 serial console servers on firmware 2.32.4 or earlier whose web interface can be reached from a network an attacker can access. A successful attack gives root on the console server and access to every serial console and device behind it. If the appliance management interface is only reachable from an isolated management network, risk is much lower; if you do not use these devices, skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Avocent ACS8000 | vendor | <= 2.32.4 | – |
2.32.4 or earlier is listed as affected2.32.5 (Aug 10 2026) and 2.32.6 (Sep 15 2026) exist, but their release notes do not mention this CVEEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The root-privileged wsserver terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system() and popen() without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.
This page as .md · .json · in your agent: get_signal("CVE-2026-65184")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.