CVE-2026-60121 describes an unauthenticated OS command injection vulnerability in VITEC Flamingo 4.12.2. The issue exists in the admin/ajax/ping.php endpoint where the host parameter is processed insecurely. Although escapeshellarg() is applied initially, the system wrapper retrieves the decoded argument and uses it in a second shell_exec() call without escaping. This double-evaluation flaw allows remote attackers to inject arbitrary OS commands that execute with root privileges due to passwordless sudo configuration. The vulnerability is remotely exploitable without authentication and has a critical CVSS score of 9.3.

An unauthenticated remote attacker can execute arbitrary OS commands with root privileges on the affected system. This can lead to full system compromise, data theft, or disruption of service. The vulnerability leverages a double-evaluation flaw in shell argument handling, bypassing initial escaping protections. The high CVSS score reflects the ease of exploitation and the severity of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the admin/ajax/ping.php endpoint to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable service to untrusted networks. Follow vendor updates closely for an official patch or mitigation instructions.