CVE-2022-31125: Roxy-Wi

Critical severity, CVSS 9.8. EPSS: 20.3% chance of exploitation in the next 30 days.

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request. This affects Roxywi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• Roxy-Wi Roxy-Wi: before 6.1.1.0 (fixed in 6.1.1.0)

Published 2022-07-06. Last modified 2026-06-17.