Executive brief
Vitec Flamingo, an IPTV distribution platform used to deliver video content across corporate and hospitality networks, contains a critical security flaw. An unauthenticated remote attacker can take complete control of the device by sending a specially crafted network request to the administration interface. This could result in a total service outage, theft of sensitive data, or the use of the device as a foothold to attack other parts of the corporate network.
Technical details
An OS command injection vulnerability exists in the 'admin/ajax/ping.php' endpoint of Vitec Flamingo version 4.12.2. The vulnerability is caused by a double-evaluation flaw: while the initial PHP script uses 'escapeshellarg()' on the 'host' POST parameter, it passes the result to a system wrapper script ('/usr/share/commands/ping'). This wrapper retrieves the argument from 'argv' and inserts it into a second 'shell_exec()' call without any further escaping. Because the wrapper is executed via passwordless sudo, an unauthenticated attacker can achieve remote code execution (RCE) with root privileges. No user interaction is required for exploitation.
Affected products
- Vitec Flamingo 4.12.2
Timeline
- 2026-07-11: disclosed: Initial researcher disclosure
- 2026-07-13: advisory: NVD and VulnCheck advisory published