CVE-2026-45749

{
  "id": "CVE-2026-45749",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-05T18:17:31.720",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /users/totp/disable` and `POST /users/totp/backup-codes` endpoints in Termix prior to version 2.3.2 accept the account password as a sole authentication factor for MFA-critical operations. An attacker who obtains a user's password (phishing, credential stuffing, the passwordHash leak in GHSA-xxxx) can disable TOTP entirely or regenerate backup codes, without ever possessing the TOTP device or knowing a valid TOTP code. This renders two-factor authentication ineffective. Version 2.3.2 patches the issue."
    },
    {
      "lang": "es",
      "value": "Termix es una plataforma de gestión de servidores basada en web con capacidades de terminal SSH, tunelización y edición de archivos. Los endpoints ’POST /users/totp/disable’ y ’POST /users/totp/backup-codes’ en Termix anteriores a la versión 2.3.2 aceptan la contraseña de la cuenta como único factor de autenticación para operaciones críticas de MFA. Un atacante que obtiene la contraseña de un usuario (phishing, relleno de credenciales, la fuga de passwordHash en GHSA-xxxx) puede deshabilitar TOTP por completo o regenerar códigos de respaldo, sin poseer nunca el dispositivo TOTP o conocer un código TOTP válido. Esto hace que la autenticación de dos factores sea ineficaz. La versión 2.3.2 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Termix-SSH",
          "product": "Termix",
          "versions": [
            {
              "version": "< 2.3.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-09T00:00:00+00:00",
          "id": "CVE-2026-45749",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-308"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.1.0",
              "versionEndExcluding": "2.3.2",
              "matchCriteriaId": "093A7241-2F44-4CF9-A881-7B83370ABB49"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-wqfw-rqj7-fv9m",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-wqfw-rqj7-fv9m",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}