CVE-2026-45549: Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host

Synopsis

An authorization bypass in Roxy-WI (versions 8.2.6.4 and prior) allows any authenticated user, including the lowest-privilege guest role, to send POST requests to the /smon/agent/action/<action> endpoint and trigger start, stop, or restart of the roxy-wi-smon-agent systemd unit on any managed server. The endpoint enforces only a valid JWT token and no role or group ownership check, so an attacker with any account can reach it over the network without elevated credentials. Successful exploitation lets the attacker stop or restart the monitoring agent on arbitrary servers, disrupting availability, and because Roxy-WI executes the action via passwordless sudo SSH, the systemd command runs as root on the target host. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Roxy-WI web interface over the network; the vulnerable endpoint is exposed via HTTP and is reachable from any network-adjacent client that can connect to the application.

• AuthenticationRequired

  A valid JWT session token is required, but any low-privilege account including a guest (role 4) account is sufficient; no elevated or administrative credentials are needed.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends the POST request directly and the action executes without any user involvement on the target side.

• Attack complexityDetail

  Attack complexity is low; the exploit is a straightforward unauthenticated-role POST request with no race conditions, memory layout dependencies, or environmental preconditions beyond holding a valid session token.

Blast Radius

• Stops or restarts the roxy-wi-smon-agent monitoring service on any server the attacker names, removing availability of the monitoring agent on those hosts.
• Because Roxy-WI issues the systemd command over its own passwordless sudo SSH credentials, the start/stop/restart action executes as root on the target server.
• Repeated or coordinated stop actions across multiple servers can disrupt monitoring coverage organization-wide, masking other ongoing attacks or outages.
• Availability of affected services tracked by the monitoring agent is degraded or silenced, potentially causing missed alerting on production infrastructure.