ntopng CVE-2026-82412

Exploitation requires an authenticated ntopng account with only non-administrator privileges (the affected endpoints lacked the isAdministrator() gate before 6.7.260717), and nmap must be installed/available on the ntopng host because the injection occurs while building the nmap command in nmap_scan_host. The scan_ports parameter must be crafted with shell metacharacters that pass validateSingleWord. A distinct, lower-barrier path exists: because the endpoints accept GET requests while ntopng's CSRF validation only applies to POST bodies, an attacker without ntopng credentials can trigger the command via a logged-in victim's browser (CSRF). Limiting factors: some form of authenticated session or a logged-in victim is needed, nmap must be present, and the product must be a version prior to 6.7.260717.

This is a genuine high-priority issue, and the CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-supported by the technical detail: a missing administrator gate lets any authenticated non-admin user reach the vulnerability-scan endpoints, and the scan_ports parameter flows through validateSingleWord (which permits shell metacharacters) into an nmap command string executed via ntop.execCmd/execCmdAsync and popen - a textbook CWE-78 OS command injection yielding code execution as the ntopng process account. The vendor GHSA advisory and four fix commits confirm the flaw and remediation (the primary commit adds isAdministrator() checks to the affected REST endpoints), so root cause and patch are well-substantiated. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - the elevated risk is driven by exploitability characteristics (low complexity, only low privileges, full C/I/A impact) rather than confirmed in-the-wild activity. One aggravating nuance beyond the base score: because the endpoints accept GET requests while ntopng's CSRF protection only validates POST bodies, an attacker can drive the command through a logged-in user's browser without holding ntopng credentials, effectively lowering the practical authentication barrier - a factor the PR:L base metric does not fully capture. A meaningful limiter is that nmap must be installed and available on the host for the injected command path to execute.

An authenticated low-privilege ntopng user (or an attacker who lures a logged-in user to a malicious web page exploiting the GET/CSRF gap) submits a scan_ports value containing shell metacharacters to the add-host-to-scan or schedule-vulnerability-scan endpoint. ntopng concatenates the value into an nmap command and executes it via popen, running the attacker's OS commands as the ntopng process account. No public exploit code is identified in the provided data, though the vulnerable code path and fix are confirmed by the vendor advisory and commits.