{"id":8953,"date":"2025-12-05T10:03:32","date_gmt":"2025-12-05T10:03:32","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/05\/cacti-command-injection-vulnerability-let-attackers-execute-malicious-code-remotely\/"},"modified":"2025-12-05T10:03:32","modified_gmt":"2025-12-05T10:03:32","slug":"cacti-command-injection-vulnerability-let-attackers-execute-malicious-code-remotely","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/05\/cacti-command-injection-vulnerability-let-attackers-execute-malicious-code-remotely\/","title":{"rendered":"Cacti Command Injection Vulnerability Let Attackers Execute Malicious Code Remotely"},"content":{"rendered":"

Cacti Command Injection Vulnerability Let Attackers Execute Malicious Code Remotely
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical command injection vulnerability in the open-source network monitoring tool Cacti allows authenticated attackers to execute arbitrary code remotely, potentially compromising the entire monitoring infrastructure.<\/p>\n

The flaw, tracked as CVE-2025-66399, affects all versions up to 1.2.28 and stems from inadequate input validation in the SNMP<\/a> device configuration functionality.<\/p>\n

The vulnerability resides in the device management interface (host.php), where SNMP community strings are processed.<\/p>\n

Flaw Allows Remote Execution of Arbitrary Commands<\/strong><\/h2>\n

When authenticated users configure monitoring devices, the application fails to filter control characters, including newlines, from the snmp_community field.<\/p>\n

The get_nfilter_request_var() function retrieves user input without stripping newline characters or validating shell metacharacters.<\/p>\n

\n\n\n\n\n\n\n\n\n\n
Detail<\/th>\nData<\/th>\n<\/tr>\n<\/thead>\n
CVE ID<\/strong><\/td>\nCVE-2025-66399<\/td>\n<\/tr>\n
Affected Product<\/strong><\/td>\nCacti (PHP-based network monitoring)<\/td>\n<\/tr>\n
CVSS Severity<\/strong><\/td>\nHigh<\/td>\n<\/tr>\n
CWE Category<\/strong><\/td>\nCWE-20: Improper Input Validation<\/td>\n<\/tr>\n
Attack Vector<\/strong><\/td>\nNetwork-based, requires authentication<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

The subsequent form_input_validate() call uses an empty regex pattern that intentionally turns off filtering.<\/p>\n

This sanitization bypass allows malicious actors to inject newline-separated commands that are stored verbatim in the database.<\/p>\n

When Cacti later executes backend SNMP operations, downstream SNMP tooling may interpret these newline-separated tokens as command boundaries.<\/p>\n

Triggering unintended command execution with the privileges of the Cacti process. Successful exploitation enables attackers to execute system-level commands with the same\u00a0privileges<\/span> as the Cacti monitoring process.<\/p>\n

Under typical deployment scenarios, this can lead to unauthorized modification of monitoring data.<\/p>\n

Execution of arbitrary system commands, unauthorized file writes, and potential full compromise of the Cacti server.<\/p>\n

The attack requires only low-privileged authenticated access, making it particularly dangerous in multi-user environments where different teams manage monitoring configurations.<\/p>\n

According to the Cacti advisory<\/a> with PoC, attackers can embed bash commands within the SNMP community field. This establishes reverse shells to external servers, effectively granting complete control over the monitoring system.<\/p>\n

The vulnerability is especially concerning because Cacti often integrates with critical network infrastructure and may have elevated access to managed devices.<\/p>\n

Administrators should immediately upgrade to Cacti version 1.2.29, which implements proper input validation for SNMP community strings.<\/p>\n

Organizations unable to patch promptly should restrict access to the device configuration interface and audit existing SNMP community strings for anomalous content.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Cacti Command Injection Vulnerability Let Attackers Execute Malicious Code Remotely<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Cacti Command Injection Vulnerability Let Attackers Execute Malicious Code Remotely A critical command injection vulnerability in the open-source network monitoring tool Cacti allows authenticated attackers to execute arbitrary code remotely, potentially compromising the entire monitoring infrastructure. The flaw, tracked as CVE-2025-66399, affects all versions up to 1.2.28 and stems from inadequate input validation in the […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,131,648],"tags":[130],"class_list":["post-8953","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8953"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=8953"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8953\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=8953"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=8953"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=8953"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}