CVE-2024-25641criticalCWE-20

CVE-2024-25641: critical vulnerability in cacti

Cacti RCE vulnerability when importing packages

Published · Updated

Follow this CVE+ Monitor cacti+ Monitor cacti

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.1epss 86%
from disclosure to weapon105 days
Published on NVDMay 13
1st PoC+105d
metasploitMay 12
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Cacti · cacti
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — cacti

In the same product, most dangerous first.

CVE-2022-46169CRITICALUnauthenticated Command InjectionEPSS 99.8%KEVCVE-2024-29895CRITICALCacti command injection in cmd_realtime.phpEPSS 98.8%CVE-2023-39361CRITICALUnauthenticated SQL Injection in graph_view.php in CactiEPSS 88.8%CVE-2023-39362HIGHAuthenticated command injection in SNMP options of a DeviceEPSS 85.4%CVE-2023-49085HIGHCacti SQL Injection vulnerabilityEPSS 74.5%CVE-2023-51448HIGHSQL Injection vulnerability when managing SNMP Notification ReceiversEPSS 67.3%