CyberRota Analysis
AI-GeneratedThe Termix web-based server management platform is vulnerable due to a flaw in the POST /database/export endpoint, which improperly includes sensitive global settings in user exports. This allows low-privileged authenticated users to access password-reset artifacts, enabling them to take over other local accounts, including those of administrators. Organizations using versions prior to 2.3.2 should prioritize upgrading to mitigate the risk of account compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains reset_code_ and temp_reset_token_ password-reset artifacts, allowing a low-privileged authenticated user to recover another local account's reset code and complete the normal password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator. This issue is fixed in version 2.3.2.