Log in Start free

Vulnerability · Published Sep 5, 2023 · Assigned by GitHub_M

CVE-2023-39362Authenticated command injection in SNMP options of a Device

High 7.2

In plain English

A high-severity OS command injection in cacti from Cacti. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 85.4% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)85.4%top 0.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20cacti1.2.25-r0ALPINE-CVE-2023-39362
Alpine:v3.21cacti1.2.25-r0ALPINE-CVE-2023-39362
Alpine:v3.22cacti1.2.25-r0ALPINE-CVE-2023-39362
Alpine:v3.23cacti1.2.25-r0ALPINE-CVE-2023-39362
Alpine:v3.24cacti1.2.25-r0ALPINE-CVE-2023-39362
Debian:12cacti1.2.24+ds1-1+deb12u1DEBIAN-CVE-2023-39362
Debian:12cacti1.2.24+ds1-1+deb12u1DSA-5550-1
Debian:13cacti1.2.25+ds1-1DEBIAN-CVE-2023-39362
Debian:14cacti1.2.25+ds1-1DEBIAN-CVE-2023-39362
Ubuntu:24.04:LTScactino fix listedUBUNTU-CVE-2023-39362

Affected products (as reported)

VendorProductVersions
Cacti cacti < 1.2.25

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References