CVE-2026-7703: AV Stumpfl Pixera RCE Vulnerability

CVE-2026-7703 Overview

CVE-2026-7703 is a code injection vulnerability in AV Stumpfl Pixera Two Media Server versions up to 25.2 R2. The flaw resides in an unspecified function of the WebSocket API component and is classified under CWE-74 (Improper Neutralization of Special Elements in Output). Remote attackers can trigger the issue across the network without authentication or user interaction. A public proof-of-concept has been released, increasing the risk of opportunistic exploitation. AV Stumpfl resolved the issue in Pixera version 25.2 R3.

Critical Impact
Unauthenticated remote attackers can inject code through the WebSocket API of Pixera Two Media Server, impacting confidentiality, integrity, and availability of the media server.

Affected Products

AV Stumpfl Pixera Two Media Server up to and including version 25.2 R2
Component: Pixera WebSocket API
Fixed version: Pixera 25.2 R3

Discovery Timeline

2026-05-03 - CVE-2026-7703 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7703

Vulnerability Analysis

The vulnerability exists in the WebSocket API exposed by Pixera Two Media Server. The API processes client-supplied input without sufficient neutralization of special elements, allowing an attacker to inject code that the server interprets and executes within its runtime context. Pixera is a media playback and show-control server widely used in live events, broadcast, and digital signage. Code injection on such systems can disrupt live productions and pivot to controlled display infrastructure. The issue is reachable over the network and requires no privileges or user interaction. A public proof-of-concept is available, and the EPSS probability remains low at the time of publication.

Root Cause

The root cause is improper input neutralization in a WebSocket API handler ([CWE-74]). The handler accepts client messages and incorporates the contents into a downstream interpreter without validating or escaping syntactically significant characters. Because the API does not enforce authentication on the affected endpoint, any attacker who can reach the WebSocket port can supply crafted payloads.

Attack Vector

An attacker establishes a WebSocket connection to the exposed Pixera API port and sends a crafted message containing injected code. The server parses the message and executes attacker-controlled logic, leading to limited compromise of confidentiality, integrity, and availability. Refer to the published GitHub PoC Repository and the VulDB Vulnerability #360872 entry for technical details. No verified exploit code is reproduced here.

Detection Methods for CVE-2026-7703

Indicators of Compromise

Unexpected WebSocket connections to Pixera Media Server API endpoints from untrusted networks or unknown source addresses.
Pixera process spawning unusual child processes or executing unexpected scripts during or after WebSocket sessions.
Anomalous outbound network connections initiated by the Pixera service host following inbound API traffic.

Detection Strategies

Inspect WebSocket message payloads to the Pixera API for syntactically unusual characters, escape sequences, or scripting primitives indicative of injection attempts.
Baseline the Pixera service's normal command set and alert on deviations such as new processes, file writes outside media directories, or registry changes on Windows hosts.
Correlate authentication-less WebSocket sessions with subsequent process or filesystem activity on the media server.

Monitoring Recommendations

Enable verbose logging on the Pixera host and forward process, network, and file events to a centralized SIEM for retention and correlation.
Monitor for connections to Pixera WebSocket ports originating outside the production control VLAN.
Track Pixera version strings across the fleet to identify hosts still running 25.2 R2 or earlier.

How to Mitigate CVE-2026-7703

Immediate Actions Required

Upgrade all Pixera Two Media Server instances to version 25.2 R3 or later, as documented in the Pixera Change Log Overview.
Restrict network reachability of the Pixera WebSocket API to trusted control networks using host and network firewalls.
Audit existing Pixera hosts for signs of prior exploitation given that a public PoC exists.

Patch Information

AV Stumpfl has released Pixera 25.2 R3, which addresses CVE-2026-7703. Operators should review the Pixera Change Log Overview and apply the update across all production and standby media servers. Tracking is also available at VulDB Vulnerability #360872.

Workarounds

Block inbound traffic to the Pixera WebSocket API port at the perimeter and segment media servers onto an isolated control network.
Disable the WebSocket API on systems where it is not required for show control or external automation.
Place a reverse proxy in front of the API that enforces authentication, source IP allow-listing, and payload validation until patching is complete.

bash

# Example host firewall rule limiting WebSocket API access to a control subnet
# Replace <pixera_ws_port> and 10.10.20.0/24 with environment-specific values
iptables -A INPUT -p tcp --dport <pixera_ws_port> -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <pixera_ws_port> -j DROP