What is this vulnerability?

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access.

How it works

This is classified as OS Command Injection. In plain terms, an attacker could use this flaw in the affected product to gain access, disrupt service, or steal data — the exact impact depends on how it’s deployed in your environment.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigations

• Apply the vendor’s security patch or update as soon as it’s available and tested.
• If no patch exists yet, apply the vendor’s temporary workaround.
• Limit network exposure of the affected system until it’s patched.
• Track the vendor advisory — disclosed vulnerabilities can move to active exploitation quickly.

Recommendations

• Confirm whether this vendor’s affected product is used anywhere in your environment.
• Patch internet-facing systems first, then internal ones.
• Prioritise by exposure and exploitability while a fix is scheduled.
• Subscribe to the vendor’s security advisories for earlier warning next time.