This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Cacti suffers from **OS Command Injection** via flawed SNMP result parsing. π **Consequences**: Attackers can inject malformed OIDs to execute arbitrary system commands.β¦
π‘οΈ **CWE**: CWE-78 (OS Command Injection). π **Flaw**: The multi-line SNMP result parser is defective. It fails to sanitize inputs, allowing malicious payloads to slip through as valid SNMP responses.
Q3Who is affected? (Versions/Components)
π’ **Vendor**: Cacti Team. π¦ **Product**: Cacti (Open-source network traffic monitoring tool). β οΈ **Affected**: All versions prior to the fix. Uses SNMPget & RRDtool for data analysis.
Q4What can hackers do? (Privileges/Data)
π **Privileges**: The attacker gains the **same privileges** as the Cacti service account. π **Data**: Can read/write any file accessible to that user.β¦
π **Auth Required**: YES. βοΈ **Level**: High (PR:H). π« **UI**: None required (UI:N). π€ **User**: Must be an **authenticated user** within the Cacti application to trigger the injection via SNMP responses.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Exploit Available**: YES. π **PoC**: Publicly available on GitHub (CVE-2025-22604-Cacti-RCE). π **Status**: Wild exploitation is possible since the proof-of-concept is live.
Q7How to self-check? (Features/Scanning)
π **Check**: Scan for Cacti instances. π‘ **Test**: Attempt to inject malformed OIDs in SNMP responses if you have valid credentials. π **Verify**: Check if the system parses multi-line SNMP outputs without sanitization.
Q8Is it fixed officially? (Patch/Mitigation)
β **Fixed**: YES. π **Date**: Published Jan 27, 2025. π οΈ **Patch**: Update Cacti to the latest version. π **Ref**: See GitHub Security Advisory GHSA-c5j8-jxj3-hh36 for the official fix commit.
Q9What if no patch? (Workaround)
π§ **Workaround**: If patching is delayed, restrict SNMP access strictly. π **Network**: Block external SNMP traffic. π€ **Access Control**: Ensure only trusted, authenticated users can interact with SNMP modules.β¦
π₯ **Priority**: CRITICAL. π **Urgency**: HIGH. π **CVSS**: 9.8 (Critical). β‘ **Action**: Patch immediately. The combination of RCE capability and public PoC makes this an immediate threat to any exposed Cacti instance.