Cacti
CVE-2025-22604
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.1, EPSS 72.2%, PoC available, patch available. Cacti is widely deployed for infrastructure monitoring. The attack requires authenticated access to add or modify monitored devices, but SNMP monitoring servers are high-value targets with broad network access. |
| Exploit ScenarioDerived | An authenticated Cacti user adds a monitoring target pointing to a device they control. The device responds to SNMP queries with crafted OIDs containing shell commands. When Cacti polls the device and processes the SNMP results, the commands execute on the Cacti server. The attacker gains OS access to the monitoring server with its extensive network reach and stored credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
Cacti versions prior to 1.2.29 contain an authenticated command injection through the SNMP result parser. By injecting malformed OIDs into SNMP responses, authenticated users can execute arbitrary system commands when the results are processed by the ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes() functions.
Earlier versions of this analysis (1)
Authenticated command injection in Cacti via malformed SNMP OID injection in multi-line result parser enables system command execution.
RemediationAI
Update to Cacti 1.2.29 or later. Restrict device management permissions to trusted administrators. Validate SNMP response data before shell processing. Implement network segmentation between the monitoring server and monitored devices.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cacti's SNMP poller parses multi-line results where parts of each OID are used as array keys that end up in system command strings. An authenticated user who can influence SNMP responses (through a compromised device or SNMP proxy) can inject crafted OIDs containing shell metacharacters. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), the malicious OID component is executed as a system command.
Know when Cacti gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.
Executive ViewAI
Organizations using Cacti face critical risk from CVE-2025-22604, a OS command injection vulnerability rated CVSS 9.1. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. With an EPSS score of 72%, this vulnerability faces very high likelihood of exploitation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)GitHub Advisory
Cacti monitoring platform prior to version 1.2.29 allows authenticated users to achieve remote code execution through th
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management fram
Cacti provides an operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vulnerabil
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB).
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. Rated high se
Cacti is an open source operational monitoring and fault management framework. Rated critical severity (CVSS 9.8), this
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary S
SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQ
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitra
Cacti provides an operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vulnerabil
Cacti is an open source operational monitoring and fault management framework. Rated high severity (CVSS 8.8), this vuln
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Package Hub 15 SP6 | Fixed |
GitHub PoC
Exploit-DB