{"id":"CVE-2023-39362","published":"2023-09-05T21:16:30Z","modified":"2025-02-27T21:01:03Z","title":"Authenticated command injection in SNMP options of a Device","vendor":"Cacti","product":"cacti","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cacti","product":"cacti","versions":["< 1.2.25"]}],"description":{"text":"Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an authenticated command injection in the SNMP options of a Device in Cacti, where the lib/snmp.php functions pass user-supplied values into an exec call without escaping or validation. An attacker with a privileged authenticated account can use a malicious string in those SNMP options to execute arbitrary commands and gain remote code execution on the underlying server, under certain conditions.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:20Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.85449,"percentile":0.9972,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-g6ff-58cj-x3cp","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/175029/Cacti-1.2.24-Command-Injection.html","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGB2UXJEUYWWA6IWVFQ3ZTP22FIHMGN/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFH3J2WVBKY4ZJNMARVOWJQK6PSLPHFH/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOQFYGLZBAWT4AWNMO7DU73QXWPXTCKH/","tags":[]},{"url":"https://www.debian.org/security/2023/dsa-5550","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00018.html","tags":[]},{"url":"https://www.vicarius.io/vsociety/posts/command-injection-in-cacti-cve-2023-39362","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-43088","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-43088","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":51740,"url":"https://www.exploit-db.com/exploits/51740","title":"Cacti 1.2.24 - Authenticated command injection when using SNMP options","type":"webapps","platform":"php","date":"2023-10-09","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2023-10-09"},"pocGithub":{"count":2,"skipped":0,"earliest":"2023-07-03","earliestUrl":"https://github.com/m3ssap0/cacti-rce-snmp-options-vulnerable-application","repos":[{"name":"jakabakos/CVE-2023-39362-cacti-snmp-command-injection-poc","url":"https://github.com/jakabakos/CVE-2023-39362-cacti-snmp-command-injection-poc","stars":2,"created":"2024-02-28"},{"name":"m3ssap0/cacti-rce-snmp-options-vulnerable-application","url":"https://github.com/m3ssap0/cacti-rce-snmp-options-vulnerable-application","stars":0,"created":"2023-07-03"}]},"first":{"date":"2023-07-03","source":"PoC-in-GitHub","url":"https://github.com/m3ssap0/cacti-rce-snmp-options-vulnerable-application"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/175029/Cacti-1.2.24-Command-Injection.html"],"flow":[],"timeline":[{"date":"2023-07-03","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2023-10-09","url":"https://github.com/m3ssap0/cacti-rce-snmp-options-vulnerable-application","provenance":"source"},{"date":"2023-09-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-39362","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":30.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9972"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}