Critical Cacti Security Flaw (CVE-2025
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-24367 +1 in the same advisory: …22604 | Authenticated Remote Code Execution in Cacti via Arbitrary PHP File Creation in Web Root CVE-2025-24367 is an authenticated remote code execution flaw in Cacti, an open-source performance and fault management framework. A user with valid (low-privilege) credentials can abuse the graph creation and graph template functionality to write arbitrary PHP scripts into the application's web root; when those scripts are requested, the web server executes them. Successful exploitation yields remote code execution on the server with high impact to confidentiality, integrity, and availability, reflected in the CVSS 4.0 score of 8.7. Any organization running an affected Cacti version whose web interface is reachable by users who can authenticate is exposed, especially if the frontend is internet-facing. A public proof-of-concept exists via the vendor advisory (GHSA-fxrq-fr7h-9rqq); confirmed in-the-wild exploitation has not been reported and the flaw is not in CISA KEV, but EPSS assigns a 54% probability of exploitation within 30 days (99th percentile), so broad scanning is likely. Do: Upgrade to Cacti 1.2.29 or later as soon as possible. Until patched, restrict access to the Cacti web interface, review which accounts hold graph-editing privileges, and check the web root for unexpected PHP files that may indicate prior exploitation. After upgrading, audit existing graphs and graph templates for tampering. | 8.7 group max | 54% | PoC |
| largetens of thousands of deployments globally (public internet scans show on the order of 10,000+ exposed Cacti instances) |
Full article284 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 29, 2025Vulnerability / Threat Intelligence
A critical security flaw has been disclosed in the Cacti open-source network monitoring and fault management framework that could allow an authenticated attacker to achieve remote code execution on susceptible instances.
The flaw, tracked as CVE-2025-22604, carries a CVSS score of 9.1 out of a maximum of 10.0.
"Due to a flaw in the multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response," the project maintainers said in an advisory released this week.
"When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability."
Successful exploitation of the vulnerability could permit an authenticated user with device management permissions to execute arbitrary code in the server, and steal, edit, or delete sensitive data.
CVE-2025-22604 affects all versions of the software prior to and including 1.2.28. It has been addressed in version 1.2.29. A security researcher who goes by the online alias u32i has been credited with discovering and reporting the flaw.
Also addressed in the latest version is CVE-2025-24367 (CVSS score: 7.2), which could permit an authenticated attacker to create arbitrary PHP scripts in the web root of the application by abusing the graph creation and graph template functionality, leading to remote code execution.
With security vulnerabilities in Cacti having come under active exploitation in the past, organizations relying on the software for network monitoring should prioritize applying the necessary patches to mitigate the risk of compromise.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/01/critical-cacti-security-flaw-cve-2025.html