CVE-2024-12828

Webmin, a widely used web-based administration tool for Unix and Linux servers, contains an OS command injection flaw (CWE-78, ZDI-CAN-22346) in its handling of CGI requests: a user-supplied string is not properly validated before being used in a system call. An attacker with valid low-privilege credentials can trigger the flaw remotely by sending a crafted CGI request with injected shell commands. Successful exploitation yields arbitrary code execution in the context of root, giving the attacker full control over the affected host. Any organization running Webmin whose web interface is reachable from a network the attacker can access is in scope, including instances exposed to the internet on the default port 10000. No public proof-of-concept or CISA KEV listing exists yet, but EPSS assigns a 33.5% probability of exploitation within 30 days (98th percentile), indicating a meaningful near-term threat.

What to do: Upgrade Webmin to the fixed release identified in the vendor/ZDI advisory as soon as possible; the available data does not state specific affected or fixed version numbers, so verify the fixed version in Webmin's release notes. Until patched, restrict access to the Webmin interface (default TCP 10000) to trusted networks or a VPN, and audit which accounts hold Webmin credentials since valid authentication is required to exploit. Review web-server and Webmin logs for anomalous CGI requests containing shell metacharacters that could indicate exploitation attempts.