Avocent ACS8000 wsserver command injection

todb

Updated October 26, 2026, 12:00am EDT

Vendors	Vertiv
Products	Avocent AC8000 Avocent AC8000
Related	CVE-2026-65184

Products

	Product
1	Avocent AC8000

CVE

CVE-2026-65184

Executive summary #

The root-privileged wsserver terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system() and popen() without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8, Critical), and is an instance of CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Technical details #

wsserver (usr/bin/wsserver) is started by etc/init.d/wstermd with start-stop-daemon -S -x /usr/bin/wsserver and no --chuid, so it runs as root. It binds a libwebsockets context on loopback TCP 2000, and Apache exposes it to the network with a bare pass-through in etc/apache2/httpd.conf.

This location carries no <Location>/<Proxy>Require, no AuthType, and no SSLVerifyClient, unlike the sibling /plugin/avtrans and /plugin/fileTransfer locations (which require a verified client certificate) and the /appliance/* and REST virtual host (Require all denied). The <Directory /> default-deny applies to the filesystem, not to a proxied WebSocket, so /termviewer is reachable without authentication.

Note that this finding has not yet been fully validated on a live device, but was discovered through firmware analysis and a virtualized target running ACS8000 firmware version 2.32.4.

Attacker value #

This issue may allow an unauthenticated attacker to execute arbitrary commands as root on the console server. The only prerequisite is network reach to the appliance web port. The result of a successful exploit is full control of the console server, including access to every serial console and managed device the target device fronts.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

2026-07-18: Initial findings discovered and documented
2026-07-21: CVE-2026-65184 reserved
2026-08-27: Vendor notified
2026-09-02: Vendor acknowledged receipt
2026-10-26: This public disclosure

Written by todb

Tod Beardsley is VP of Security Research at runZero, where he "kicks assets and fakes frames." Prior to 2025, he was the Section Chief for the Vulnerability Response section for CSD/VM/VRC at CISA, the Cybersecurity and Infrastructure Security Agency, part of the US government, and a seasonal Travis County Election Judge in Texas. He's also a founder and CNA point of contact for AHA!. Tod spends much of his time involved in vulnerability research and coordinated vulnerability disclosure (CVD). He has over 30 years of hands-on security experience, stretching from in-band telephony switching to modern ICS/OT implementations. He has held IT ops, security, software engineering, and management positions in large organizations such as the US Government, Rapid7, 3Com, Dell, and Westinghouse, as both an offensive and defensive practitioner. Tod is a CVE Board member, has authored several research papers, and is an internationally-tolerated horror fiction expert.

More about todb