Executive brief
Vitec Flamingo, an IPTV distribution head-end appliance, contains a critical security flaw in its graph generation component. A remote attacker can exploit this to take complete control of the device without needing a username or password. Because the system's web server has elevated administrative privileges, an attacker can permanently compromise the device, steal data, or use it as a jumping-off point to attack other parts of the corporate network.
Technical details
An OS command injection vulnerability exists in the Vitec Flamingo IPTV appliance due to improper neutralization of shell metacharacters in the 'admin/ajax/gen_graphs.php' endpoint. The script accepts user-controlled GET parameters (start, end, key, and format) and passes them directly to the PHP passthru() function to execute RRDTool commands. A remote, unauthenticated attacker can inject arbitrary shell commands via these parameters. Because the web server context is configured with passwordless sudo access, injected commands execute with root privileges, leading to full system compromise. As of the advisory date, the vulnerability is confirmed in version 4.12.2.
Affected products
- Vitec Flamingo 4.12.2
Timeline
- 2026-07-11: disclosed: Initial researcher disclosure by Yassine Damiri
- 2026-07-13: advisory: NVD and VulnCheck published advisory details