VulnSocial

CVE-2026-45748General(termix / termix)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch termix termix systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (`endpointIP`, `endpointUsername`, `password`) directly into a shell command without escaping, allowing persistent OS command injection on the source SSH host. Version 2.3.2 patches the issue.

termix CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • termix

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-06-06); latest day: 1
  • 4 total mentions across 2 days

Affected systems

Vendors
termix
Products
termix

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-06-06: 3Mentions · 2026-06-12: 1Patch / Workaround · 2026-06-12: 1Technical Details · 2026-06-06: 1Technical Details · 2026-06-12: 106-0606-12
Signal classification3 categories
General
250.0%
Disclosure
125.0%
Patch
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-063
Disclosure1General2
2026-06-121
Patch1
Full discourse4 posts
  • SecAlerts@SecAlertsCo
    Patch

    🔓 Unauthenticated RCE in Termix via SSH tunnel command injection. CVE-2026-45748 scores 9.8 critical - no auth, no user interaction needed. Update to v2.3.2 now. #infosec #cybersecurity https://secalerts.co/vulnerability/CVE-2026-45748 https://t.co/XuOQbQiFl4

    Post summary

    The tweet announces a critical unauthenticated RCE in Termix (CVE‑2026‑45748) and notes that a fix is available in version 2.3.2, with no mention of a PoC or active exploitation.

    0000063
    835 followersView on X
  • ThreatCluster@threatcluster
    Disclosure

    Termix server management platform versions before 2.3.2 have RCE flaws CVE-2026-45748 and CVE-2026-45750 in POST /ssh/tunnel/connect and GET /ssh/file_manager/ssh/resolvePath, allowing OS command injection, CVE records show. https://threatcluster.io/cluster/multiple-cves-discovered-in-termix-server-management-platfor-b8cd4a92

    Post summary

    Termix server management platform versions prior to 2.3.2 are vulnerable to RCE via OS command injection in the specified endpoints (CVE‑2026‑45748 and CVE‑2026‑45750), but no proof‑of‑concept, exploit code, or patch information is provided.

    00000104
    313 followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-45748 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior … https://www.cve.org/CVERecord?id=CVE-2026-45748 ----- Traducción: CVE-2026-45748 Ter… http://infoflow.cloud`

    Post summary

    The tweet merely references CVE-2026-45748 and links to its CVE record without providing further technical or operational details.

    0000029
    79 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-45748 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior … https://www.cve.org/CVERecord?id=CVE-2026-45748

    Post summary

    The post merely cites CVE-2026-45748 for Termix, giving an endpoint reference but no further technical, exploit, or mitigation details.

    00000277
    57.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apptermixtermix---

Explore more

Back to dashboardtermix CVEstermix vulnerabilities