Multiple Vulnerabilities Found In Cacti Network Monitoring Tool

Cacti network monitoring software users need to update their systems to the latest version as the maintainers of the framework patch numerous vulnerabilities. These security flaws also include a critical remote code execution vulnerability that could allow unwarranted access to the target system.

Critical RCE Flaws Affected Cacti Framework

First discovered and reported by the security researcher Egidio Romano, this critical vulnerability in the Cacti network monitoring tool could allow remote code execution.

Identified as CVE-2024-25641 (CVSS 9.1), the vulnerability is basically an arbitrary file write issue affecting the import_package() function. An authenticated adversary with “Import Templates” permission could exploit the flaw to execute arbitrary PHP codes on the target server.

As explained in an advisory, Romano observed the vulnerability affecting Cacti versions including and prior to v.1.2.26. Following Romano’s report, the maintainers patched the vulnerability with Cacti version 1.2.27.

In addition, another critical severity vulnerability, CVE-2024-29895 (CVSS 10.0), also received a fix from the maintainers. However, it primarily affected the development versions 1.3.x. This vulnerability could allow command injection from an unauthenticated adversary when the register_argc_argv PHP option is On.

Other Cacti Network Monitoring Tool Vulnerabilities Also Patched

Alongside this critical vulnerability, the latest Cacti update also addressed numerous other vulnerabilities, as evident through the changelog on its website. These include the following two high-severity vulnerabilities.

• CVE-2024-31445(CVSS 8.8): An SQL injection vulnerability affecting api_automation.php. Exploiting this flaw could allow elevated privileges and remote code execution to an authenticated attacker.
• CVE-2024-31459: A high-severity file inclusion vulnerability affecting the lib/plugin.php file. Exploiting the flaw together with SQL injection vulnerabilities could allow remote code execution attacks.

Besides, the maintainers also patched numerous moderate severity issues with version 1.2.27, which is the version users should upgrade to in order to receive all security fixes. Cacti also patched a moderate severity vulnerability reflected XSS, CVE-2024-30268, in the development versions 1.3.x.

Let us know your thoughts in the comments.