CVE-2026-65184

Summary

The wsserver daemon executes arbitrary shell commands built from untrusted WebSocket input without sanitization, enabling remote code execution as root.

Exploitability

Exploitation is straightforward for an unauthenticated attacker over the network due to missing input validation and direct use of system() and popen().

Blast radius

Successful exploitation grants full system compromise with root privileges, affecting confidentiality, integrity, and availability of the host.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to wsserver version 2.590 or later, which includes proper input sanitization and appliance-session validation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.