---
id: "CVE-2026-65184"
kind: "vulnerability"
aliases: ["CVE-2026-65184"]
title: "wsserver terminal daemon lets unauthenticated WebSocket clients run root shell commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Avocent ACS8000", "fixed": [], "affected": "<= 2.32.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["acs800", "acs8000", "appliance", "avocent", "console-server", "infrastructure", "out-of-band", "pre-auth", "vertiv", "websocket", "wsserver"]
not_affected_if: ["firmware-above-2.32.4-unconfirmed", "management-network-only"]
published_at: "2026-10-26T15:16:41+00:00"
first_seen_at: "2026-10-26T16:02:25+00:00"
updated_at: "2026-10-26T16:04:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65184", "first_seen_at": "2026-10-26T16:02:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T16:04:26+00:00"}]
---

# wsserver terminal daemon lets unauthenticated WebSocket clients run root shell commands

Unauthenticated command injection as root in the wsserver terminal-bridge daemon of Vertiv Avocent ACS8000 console servers (firmware <= 2.32.4). Apache proxies /termviewer to wsserver (loopback TCP 2000) with no authentication, and client WebSocket fields reach system()/popen() unquoted. Found by runZero (HD Moore) from firmware analysis; not yet confirmed on a live device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Avocent ACS8000 affected <= 2.32.4 fixed ?

## How to check

Check the firmware version in the ACS8000/ACS800 web UI or CLI: 2.32.4 or earlier is listed as affected. Check whether the appliance web port (HTTP/HTTPS) is reachable from untrusted networks. The vulnerable route is the /termviewer WebSocket path, proxied in /etc/apache2/httpd.conf with no Require/AuthType (per runZero).

## Fix

unknown: no Vertiv advisory found. Later firmware 2.32.5 (Aug 10 2026) and 2.32.6 (Sep 15 2026) exist, but their release notes do not mention this CVE. Ask Vertiv support. Until then, restrict access to the web port.

## Timeline

- 2026-10-26T16:02:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65184
- 2026-10-26T16:04:26+00:00 analyst — Product identified from NVD JSON API + runZero advisory (finder, not vendor): Vertiv Avocent ACS8000 (blog also says ACS800), <= 2.32.4. No Vertiv advisory found; fix unknown (2.32.5/2.32.6 exist, no statement they fix it). Not validated on live device (firmware analysis/virtualized). No PoC, no exploitation seen, no X chatter. Nothing marked verified: no vendor text.

## Documents

- [advisory] runZero: Avocent ACS8000 wsserver command injection https://www.runzero.com/advisories/avocent-acs8000-wsserver-cmdinj-cve-2026-65184
- [describes] runZero: Lights Out - BMC/OOB disclosures https://www.runzero.com/blog/lights-out-exposed/
- [mentions] Vertiv Avocent ACS8000 software downloads https://www.vertiv.com/en-us/support/software-download/it-management/avocent-acs-8000-advanced-control-systems-software-downloads/

## From the sources

The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_