IX Family vulnerability

What happened

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device.

Affected versions

IX Family: 21.8.24.139 through 26.7.90.14 (custom); 0 through 21.8.24.139 (custom); 21.8.24.139 through 22.5.50.66 (custom); 21.8.24.139 through 22.5.50.62 (custom); 21.8.24.139 through 23.12.1.56 (custom) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.