CRITICAL🇵🇱 Wersja polska

CVE-2025-22604

CVSS 9.1v3.1pub. 2025-01-27upd. 2025-11-03

Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Cacti

    APP
    Cacti
    < 1.2.29
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2022-46169CRITICAL9.8⚠ KEVten sam produkt

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault manag...

CVE-2026-39948CRITICAL9.3PL ✓ten sam produkt

Cacti: Pre-auth SQL injection przez parametr rfilter (SQLi)

CVE-2026-39938CRITICAL9.8PL ✓ten sam produkt

Niezautoryzowany path traversal i command injection w Cacti (LFI)

CVE-2026-39893CRITICAL9.8PL ✓ten sam produkt

SQL Injection w Cacti — atak bez uwierzytelnienia przez parametr rfilter

CVE-2026-39955CRITICAL9.8PL ✓ten sam produkt

SQL Injection przed uwierzytelnieniem w Cacti (graph_view.php)