CVE-2026-45561

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.4

Description The application fails to properly validate the URL path component in the /smon/agent/{version,uptime,status,checks}/<server ip> family of routes. This component is passed directly into a requests.get() call, allowing the use of arbitrary IPv4 literals, such as 127.0.0.1, RFC1918 ranges, or 169.254.169.254. This occurs because the path is only constrained by the default Flask URL converter, which permits any value.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.