CVE-2026-61498 is an unauthenticated OS command injection vulnerability affecting VITEC Flamingo 4.12.2. The vulnerability exists in the admin/ajax/gen_graphs.php endpoint, where user-supplied HTTP GET parameters (start, end, key, format) are passed directly to shell commands via the passthru() function without proper sanitization. Due to the web server running with passwordless sudo privileges, exploitation allows remote attackers to execute arbitrary OS commands with root-level access. The CVSS 4.0 base score is 9.3, indicating critical severity. No vendor advisory or patch information is currently available.

Successful exploitation permits remote unauthenticated attackers to execute arbitrary operating system commands with root privileges on the affected system. This can lead to full system compromise, data theft, service disruption, or further network penetration. The vulnerability is critical due to the combination of unauthenticated access, root-level command execution, and lack of input sanitization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider implementing network-level controls to limit exposure. Monitor for any vendor updates or security advisories from VITEC regarding this vulnerability.