Authenticated command injection in SNMP options of a Device
Cacti · cacti
The flaw is an authenticated command injection in the SNMP options of a Device in Cacti, where the lib/snmp.php functions pass user-supplied values into an exec call without escaping or validation. An attacker with a privileged authenticated account can use a malicious string in those SNMP options to execute arbitrary commands and gain remote code execution on the underlying server, under certain conditions.
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available 2 months before disclosure.
- Public exploit codePoC-in-GitHub2 mo before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.