CVE-2024-43363

CVE-2024-43363 is a PHP code injection flaw (CWE-94) in Cacti, an open source performance and fault management framework, triggered through log poisoning with a malicious device hostname. An attacker with admin privileges creates a device whose hostname contains embedded PHP code, then re-runs the installer (only step 5 needs to be completed) to point the Cacti log file at a PHP file; once the poisoned hostname is written to that log, the attacker executes arbitrary code by requesting the log file's URL. Successful exploitation yields remote command execution on the web server under the web server user's privileges, potentially leading to broader system compromise. All Cacti deployments running versions prior to 1.2.28 are affected; because the attack requires valid admin credentials (CVSS PR:H), practical exposure depends heavily on how many privileged accounts could be compromised. As of the available data there is no confirmed in-the-wild exploitation and the flaw is not in CISA KEV, but a public advisory/PoC exists and EPSS assigns a 35.6% probability of exploitation within 30 days (98th percentile), making prompt patching advisable.

What to do: Upgrade to Cacti 1.2.28 or later, as no workarounds are known. Since exploitation requires admin privileges, restrict and audit administrative access, check for device hostnames containing PHP code and for log paths set to PHP files, and avoid serving the Cacti log as an executable PHP file. Prioritize patching internet-facing Cacti instances given the elevated EPSS score and available public PoC.