CVE-2025-22604 - Cacti has Authenticated RCE via multi-line SNMP responses

Back Back to CVE browser

CRITICAL

Cacti has Authenticated RCE via multi-line SNMP responses

Published Jan 27, 2025

9.1

CRITICAL

CVSS 3.1

EPSS 5.38%

Description

Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.

Affected products

Vendor Cacti Product Cacti Default
n/a
- Version
  <= 1.2.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cacti

n/a

Version	Status	Constraints
<= 1.2.8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-2878
Advisory
https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0
x_refsource_MISCPatch
https://github.com/Cacti/cacti/security/advisories/GHSA-c5j8-jxj3-hh36
x_refsource_CONFIRMExploitVendor Advisory
https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-2878		Advisory
https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0		x_refsource_MISCPatch
https://github.com/Cacti/cacti/security/advisories/GHSA-c5j8-jxj3-hh36		x_refsource_CONFIRMExploitVendor Advisory
https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html