{"id":"CVE-2026-65184","kind":"vulnerability","aliases":["CVE-2026-65184"],"related":[],"title":"wsserver terminal daemon lets unauthenticated WebSocket clients run root shell commands","description":"The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.","summary":"Unauthenticated command injection as root in the wsserver terminal-bridge daemon of Vertiv Avocent ACS8000 console servers (firmware <= 2.32.4). Apache proxies /termviewer to wsserver (loopback TCP 2000) with no authentication, and client WebSocket fields reach system()/popen() unquoted. Found by runZero (HD Moore) from firmware analysis; not yet confirmed on a live device.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Avocent ACS8000","fixed":[],"affected":"<= 2.32.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["acs800","acs8000","appliance","avocent","console-server","infrastructure","out-of-band","pre-auth","vertiv","websocket","wsserver"],"not_affected_if":["firmware-above-2.32.4-unconfirmed","management-network-only"],"how_to_check":"Check the firmware version in the ACS8000/ACS800 web UI or CLI: 2.32.4 or earlier is listed as affected. Check whether the appliance web port (HTTP/HTTPS) is reachable from untrusted networks. The vulnerable route is the /termviewer WebSocket path, proxied in /etc/apache2/httpd.conf with no Require/AuthType (per runZero).","fix":"unknown: no Vertiv advisory found. Later firmware 2.32.5 (Aug 10 2026) and 2.32.6 (Sep 15 2026) exist, but their release notes do not mention this CVE. Ask Vertiv support. Until then, restrict access to the web port.","status":"open","published_at":"2026-10-26T15:16:41+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:03:31+00:00","updated_at":"2026-10-26T16:04:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T16:03:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"wsserver terminal daemon lets unauthenticated WebSocket clients run root shell commands","impact":"high","summary":"The root-privileged wsserver terminal-bridge daemon builds shell commands from WebSocket fields and passes them unquoted to system() and popen(). Its public-key session path skips the appliance session check, so an attacker can inject commands that run as root.","category":"infrastructure","nicknames":[],"who_cares":["wsserver","appliance","websocket"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands as root on the device","analyst_note":"Identify the vendor and affected product and firmware versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-65184; the sources do not name the product.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00052,"input_tokens":3314,"output_tokens":377,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify the vendor and affected product and firmware versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-65184; the sources do not name the product.","search":"'-2026':13A,16A '-65184':14A,17A '/popen':75B '/termviewer':60B '2.32.4':57B '2000':65B 'acs800':20B 'acs8000':19A,21B,53B 'analysi':84B 'apach':58B 'applianc':22B,137C 'appliance-sess':136C 'auth':34B 'authent':68B 'avoc':23B,52B 'avocent':18A 'band':31B 'bridg':48B,99C 'build':101C 'charact':123C 'character-set':122C 'check':139C 'client':7A,70B,107C 'client-suppli':106C 'command':11A,39B,104C 'confirm':87B 'consol':25B,54B 'console-serv':24B 'cve':12A,15A 'daemon':3A,49B,100C,127C 'devic':91B 'escap':120C 'field':72B,110C 'firmwar':56B,83B 'found':77B 'hd':80B 'infrastructur':27B 'inject':40B 'key':131C 'let':4A 'live':90B 'loopback':63B 'moor':81B 'out-of-band':28B 'pass':112C 'path':133C 'perform':134C 'popen':117C 'pre':33B 'pre-auth':32B 'privileg':95C 'proxi':59B 'public':130C 'public-key':129C 'quot':119C 'reach':73B 'root':9A,42B,94C 'root-privileg':93C 'run':8A 'runzero':79B 'server':26B,55B 'session':132C,138C 'set':124C 'shell':10A,103C 'suppli':108C 'system':74B,115C 'tcp':64B 'termin':2A,47B,98C 'terminal-bridg':46B,97C 'unauthent':5A,38B 'unquot':76B 'valid':125C 'vertiv':35B,51B 'websocket':6A,36B,71B,109C 'without':118C 'wsserver':1A,37B,45B,62B,96C 'yet':86B","nicknames":[],"mitigations":[],"who_affected":"Teams running Vertiv Avocent ACS8000 or ACS800 serial console servers on firmware 2.32.4 or earlier whose web interface can be reached from a network an attacker can access. A successful attack gives root on the console server and access to every serial console and device behind it. If the appliance management interface is only reachable from an isolated management network, risk is much lower; if you do not use these devices, skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"44488dab-36db-4358-99f9-bc116477f914","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65184","severity":null,"published_at":"2026-10-26T15:16:41+00:00","modified_at":"2026-10-26T15:16:41+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-65184:834","url":null,"severity":null,"published_at":"2026-10-26T16:04:26+00:00","modified_at":"2026-10-26T16:04:26+00:00","first_seen_at":"2026-10-26T16:04:26+00:00","fetched_at":"2026-10-26T16:04:26+00:00","note":"Product identified from NVD JSON API + runZero advisory (finder, not vendor): Vertiv Avocent ACS8000 (blog also says ACS800), <= 2.32.4. No Vertiv advisory found; fix unknown (2.32.5/2.32.6 exist, no statement they fix it). Not validated on live device (firmware analysis/virtualized). No PoC, no exploitation seen, no X chatter. Nothing marked verified: no vendor text."}],"documents":[{"id":3941,"url":"https://www.runzero.com/advisories/avocent-acs8000-wsserver-cmdinj-cve-2026-65184","title":"runZero: Avocent ACS8000 wsserver command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3942,"url":"https://www.runzero.com/blog/lights-out-exposed/","title":"runZero: Lights Out - BMC/OOB disclosures","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3943,"url":"https://www.vertiv.com/en-us/support/software-download/it-management/avocent-acs-8000-advanced-control-systems-software-downloads/","title":"Vertiv Avocent ACS8000 software downloads","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}