CVE-2025-22604

Published Jan 27, 2025

Last updated a month ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-22604 is a critical vulnerability affecting Cacti network monitoring software versions 1.2.28 and earlier. The vulnerability exists in the multi-line SNMP response parser due to inadequate filtering of Object Identifiers (OIDs). While the values within the responses are filtered, the OIDs themselves are not. This allows authenticated attackers with device management permissions to inject specially crafted OIDs, leading to remote code execution on the server. Parts of these manipulated OIDs are then used as keys in an array involved in constructing system commands, enabling the attacker to inject and execute arbitrary commands with the same privileges as the Cacti application. The vulnerability has been addressed in Cacti version 1.2.29. It was discovered and reported by a security researcher known as u32i. Exploitation could allow attackers to execute arbitrary code, potentially leading to data breaches, data manipulation, or disruption of network operations. As of today, January 31, 2025, this information is current, but the situation may evolve. It is recommended to update to the latest version of Cacti to mitigate this vulnerability.

Description: Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.
Source: security-advisories@github.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C0B80A90-97E0-49C0-A780-695E17B0568C",
            "versionEndExcluding": "1.2.29"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]