Multiple vulnerabilities found in Cacti Network Monitoring Tool

2 Min Read

Users of Cacti network monitoring software should update their systems to the latest version as the framework’s maintainers patch numerous vulnerabilities. These security flaws also include a critical remote code execution vulnerability that could allow unwarranted access to the target system.

Critical RCE errors affected the Cacti framework

This critical vulnerability in the Cacti network monitoring tool was first discovered and reported by security researcher Egidio Romano and could allow remote code execution.

Identified as CVE-2024-25641 (CVSS 9.1) the vulnerability is actually a random file write issue that affects the import_package() function. An authenticated adversary with the “Import Templates” permission could exploit the flaw to execute arbitrary PHP codes on the target server.

As explained in a advisory, Romano has observed the vulnerability affecting Cacti versions including and before v.1.2.26. Following Romano’s report, administrators patched the vulnerability with Cacti version 1.2.27.

In addition, there is another critical severity vulnerability, CVE-2024-29895 (CVSS 10.0), has also received a fix from the maintainers. However, it mainly affected the development versions 1.3.x. This vulnerability could allow command injection from an unauthenticated adversary when the register_argc_argv PHP option is enabled.

Other vulnerabilities in the Cacti Network Monitoring Tool have also been fixed

In addition to this critical vulnerability, the latest Cacti update also addressed numerous other vulnerabilities, as evidenced by the changelog on its website. These include the following two very serious vulnerabilities.

  • CVE-2024-31445(CVSS 8.8): A SQL injection vulnerability affecting api_automation.php. Exploiting this flaw could allow elevated privileges and remote code execution by an authenticated attacker.
  • CVE-2024-31459: A high-severity file inclusion vulnerability that affects the lib/plugin.php file. Exploiting the flaw in combination with SQL injection vulnerabilities could enable remote code execution attacks.
See also  ESET takes part in global operation to disrupt the Grandoreiro banking trojan

In addition, the administrators also fixed numerous medium severity issues with version 1.2.27, the version to which users must upgrade to receive all security fixes. Cacti also patched a moderate severity vulnerability, reflected XSS, CVE-2024-30268in development versions 1.3.x.

Let us know your thoughts in the comments.

Share This Article
Leave a comment

Leave a Reply

Your email address will not be published. Required fields are marked *