Vertiv - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/vertiv/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 17:03:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVertiv Avocent ACS8000: wsserver daemon command injection (CVE-2026-65184)https://feed.craftedsignal.io/briefs/2026-10-avocent-acs8000-cve-2026-65184/Mon, 26 Oct 2026 17:03:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-avocent-acs8000-cve-2026-65184/An unauthenticated command injection vulnerability in the Avocent ACS8000 wsserver daemon allows attackers to execute arbitrary commands with root privileges by sending malicious input via WebSocket fields.CVE-2026-65184 is a critical command injection vulnerability in the Avocent ACS8000 terminal server. The wsserver daemon improperly handles client-supplied input within WebSocket fields before passing them to system() or popen() calls. The vulnerability is unauthenticated and does not require session validation, granting successful attackers full root-level execution on the appliance.

Impact

Successful exploitation allows unauthenticated attackers to gain full root-level control over affected Avocent ACS8000 appliances, potentially enabling full system compromise, persistent backdoor access, and lateral movement within the network management infrastructure.

Recommendation

  • Immediately identify all internet-facing Avocent ACS8000 appliances and restrict management interface access to trusted networks.
  • Review the official runZero advisory and follow instructions from Vertiv for patching or configuration hardening.
  • Prioritize the implementation of network-level traffic inspection for WebSocket traffic directed at ACS8000 management interfaces.
]]>criticaladvisorycommand-injectionrcenetwork-applianceiot