Security researchers have identified a dangerous command injection vulnerability in Cacti, the widely-used open-source network monitoring and graphing solution.
The flaw resides in how Cacti handles SNMP community strings during device configuration, enabling authenticated users to execute malicious code remotely with the privileges of the Cacti process.
Technical Details
The vulnerability exists in Cacti’s device management feature, specifically within the host.php file that handles device creation and editing operations.
When users configure SNMP-enabled devices through the web interface at host.php?action=save, the application fails to properly sanitize the snmp_community input field.
The problematic code retrieves SNMP community strings using the get_nfilter_request_var('snmp_community') function.
This function performs no filtering of newline characters and does not validate shell metacharacters or command-separator characters.
The value is then passed to api_device_save() where the sanitization regex is intentionally left empty, completely disabling input validation.
As a result, crafted multi-line community strings containing control characters, including newlines, are accepted, stored verbatim in the database, and later embedded into backend SNMP operations.
When downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this leads to unintended command execution.
To exploit this vulnerability, an attacker with authenticated access to Cacti can craft a malicious POST request to create a new device.
The snmp_community parameter can contain embedded shell commands using URL-encoded newlines and bash reverse shell payloads.
Once the device is saved and accessed through the management interface, the injected commands execute with the privileges of the Cacti process.
For example, an attacker could inject a reverse shell payload within the community string field. When the device polls using SNMP, the malicious commands are processed, establishing a connection back to the attacker’s listener.
The consequences of successful exploitation are severe. Attackers can achieve unauthorized modification of monitoring data, execution of system-level commands, unauthorized file writes, and potential full compromise of the Cacti server.
In enterprise environments where Cacti monitors critical infrastructure, this vulnerability poses significant risk to network security and operational integrity.
Organizations running Cacti should immediately audit their installations and restrict access to device configuration functionality.
Network segmentation and least-privilege access controls can help reduce the impact of potential exploitation while awaiting official fixes.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The flaw resides in how Cacti handles SNMP community strings during device configuration, enabling authenticated users to execute malicious code remotely with the privileges of the Cacti process.){kind=link}