by Kastro
Paper/Archive/CVE-2025-22604

CVE-2025-22604

Cacti cacti — Cacti has Authenticated RCE via multi-line SNMP responses

EPSS 5%public exploitCVSS 9.1
critical.is priorityof 100
56
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 92.7.927 × 2018.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.

Affected

ProductAffectedFixed inSource
cacti<= 1.2.8–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/Cacti/cacti/security/advisories/GHSA-c5j8-jxj3-hh36refgithub.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0reflists.debian.org/debian-lts-announce/2025/02/msg00010.html