CVE-2025-24367

CVE-2025-24367 is an authenticated remote code execution flaw in Cacti, an open-source performance and fault management framework. A user with valid (low-privilege) credentials can abuse the graph creation and graph template functionality to write arbitrary PHP scripts into the application's web root; when those scripts are requested, the web server executes them. Successful exploitation yields remote code execution on the server with high impact to confidentiality, integrity, and availability, reflected in the CVSS 4.0 score of 8.7. Any organization running an affected Cacti version whose web interface is reachable by users who can authenticate is exposed, especially if the frontend is internet-facing. A public proof-of-concept exists via the vendor advisory (GHSA-fxrq-fr7h-9rqq); confirmed in-the-wild exploitation has not been reported and the flaw is not in CISA KEV, but EPSS assigns a 54% probability of exploitation within 30 days (99th percentile), so broad scanning is likely.

What to do: Upgrade to Cacti 1.2.29 or later as soon as possible. Until patched, restrict access to the Cacti web interface, review which accounts hold graph-editing privileges, and check the web root for unexpected PHP files that may indicate prior exploitation. After upgrading, audit existing graphs and graph templates for tampering.