CVE-2026-61498 is an unauthenticated OS command injection vulnerability in VITEC Flamingo 4.12.2. The vulnerability exists in the admin/ajax/gen_graphs.php endpoint, where user-supplied HTTP GET parameters (start, end, key, format) are passed directly to shell commands via the PHP passthru() function without proper sanitization. Due to the web server running with passwordless sudo privileges, exploitation allows remote attackers to execute arbitrary OS commands with root-level access. This vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. No vendor advisory or patch information is currently available.

Successful exploitation enables remote unauthenticated attackers to execute arbitrary operating system commands with root privileges on the affected system. This can lead to full system compromise, data theft, service disruption, or further attacks within the network. The vulnerability is critical due to the lack of authentication, ease of exploitation, and high privileges granted to the executed commands.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint by network controls or web application firewall rules to block malicious input patterns. Consider disabling or restricting the use of passwordless sudo for the web server user to reduce impact. Monitor for any vendor updates or security advisories regarding this vulnerability.