CVE-2026-53549
HighCVSS 7.7Summary
In Termix before 2.3.2, the POST /host/db/proxy/test endpoint accepts singleProxy, proxyChain, and testTarget fields without validating destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure. Connection errors disclose host reachability, and metadata access can expose cloud credentials.
Risk Assessment
The risk is that the Termix server can be used to scan internal networks and access sensitive services, potentially leading to credential disclosure and security compromise.
Recommendation
Upgrade Termix to version 2.3.2 or later. Also restrict access to the test endpoint and implement destination address validation.
Original NVD description (English source)
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure reachable from the Termix server. Structured connection errors disclose host reachability and timing information, and successful metadata access can expose cloud credentials. This issue is fixed in version 2.3.2.