CVE-2026-60121: Vitec Flamingo OS Command Injection RCE

CVE-2026-60121 Overview

CVE-2026-60121 is an unauthenticated OS command injection vulnerability in Vitec Flamingo 4.12.2. The flaw resides in the admin/ajax/ping.php endpoint and stems from a double-evaluation of shell arguments. Remote attackers can send a crafted POST request to the host parameter and execute arbitrary operating system commands as root through passwordless sudo. The vulnerability is classified under CWE-78: OS Command Injection and does not require authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can achieve root-level command execution on affected Vitec Flamingo 4.12.2 deployments by injecting shell metacharacters into the host POST parameter of admin/ajax/ping.php.

Affected Products

Vitec Flamingo 4.12.2
Vitec IPTV Distribution Solution deployments running Flamingo 4
Any downstream integration exposing the admin/ajax/ping.php endpoint

Discovery Timeline

2026-07-13 - CVE-2026-60121 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-60121

Vulnerability Analysis

The vulnerability exists in the ping diagnostic endpoint bundled with the Vitec Flamingo 4.12.2 administrative interface. The endpoint accepts a host parameter via HTTP POST and passes it to a system wrapper intended to invoke the operating system ping utility. The initial handler applies escapeshellarg() to the user-supplied value, which normally protects against shell metacharacter injection.

The protection breaks down because the wrapper script re-processes the argument. It retrieves the already-decoded value from argv and concatenates it into a second shell_exec() invocation without re-escaping. This double-evaluation pattern nullifies the initial sanitization and produces a direct command injection sink. Because the endpoint is reachable without authentication and the wrapper executes under passwordless sudo, exploitation yields root-level code execution on the host operating system.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Sanitization is applied only at the first stage of a two-stage command construction pipeline, leaving the second shell_exec() call operating on attacker-controlled data. See the VulnCheck Vitec Advisory for the vendor coordination context.

Attack Vector

An attacker sends an unauthenticated HTTP POST request to admin/ajax/ping.php with a host value containing shell metacharacters or command substitution syntax. The value survives the initial escapeshellarg() call, is decoded when read from argv in the wrapper, and is then executed by the unescaped shell_exec(). The resulting process runs as root. Further technical description is available at the Damiri CVE-2026-60121 Reference.

Detection Methods for CVE-2026-60121

Indicators of Compromise

POST requests to /admin/ajax/ping.php containing shell metacharacters such as ;, |, &, backticks, or $( in the host parameter.
Unexpected child processes of the web server user invoking shells, wget, curl, nc, or python after a request to the ping endpoint.
New cron entries, SSH keys, or files created in system directories following access to admin/ajax/ping.php.
Outbound network connections from the Flamingo host to unfamiliar IP addresses shortly after ping endpoint activity.

Detection Strategies

Inspect web server access logs for POST requests to admin/ajax/ping.php with abnormally long or non-hostname host values.
Correlate web request telemetry with process creation events showing shells or reconnaissance binaries spawned by the PHP handler.
Alert on privilege transitions where the web server user executes commands as root via sudo without a corresponding administrative session.

Monitoring Recommendations

Enable verbose PHP request logging on the Flamingo application server to capture POST bodies sent to diagnostic endpoints.
Monitor sudo audit logs for invocations of the ping wrapper and flag arguments containing shell metacharacters.
Deploy egress filtering and alert on outbound traffic from the Flamingo host to non-approved destinations.

How to Mitigate CVE-2026-60121

Immediate Actions Required

Restrict network access to the Vitec Flamingo administrative interface using firewall rules or a VPN until a patch is applied.
Disable or remove the admin/ajax/ping.php endpoint if it is not required for operations.
Review the passwordless sudo configuration for the web server user and remove entries that permit the ping wrapper to run as root.
Audit affected hosts for signs of prior exploitation, including new accounts, cron jobs, and persistence artifacts.

Patch Information

No vendor-published patch reference is available in the enriched CVE data at the time of writing. Consult the VulnCheck Vitec Advisory and the Vitec IPTV Distribution Solution product page for vendor updates and fixed release information.

Workarounds

Block external access to /admin/ajax/ping.php at the reverse proxy or web application firewall layer.
Enforce strict input validation on the host parameter, restricting values to a regex allowlist matching valid hostnames or IP addresses before any shell invocation.
Replace the vulnerable wrapper with a native library call or execute ping using an exec variant that does not spawn a shell, such as pcntl_exec with a fixed argv.
Remove passwordless sudo privileges from the web server account and require least-privilege execution for diagnostic tools.

bash

# Example nginx configuration to block the vulnerable endpoint
location = /admin/ajax/ping.php {
    deny all;
    return 403;
}