EUVD-2026-71778
GHSA-x89w-3wg2-6mvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated network user can irreversibly delete all pools (I:H); no confidentiality impact; minor availability disruption to monitoring workflows (A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.
AnalysisAI
Missing authorization on the host pool bulk-delete REST endpoint in ntopng before 6.7.260717 allows any authenticated low-privileged user to irreversibly destroy all configured host pools and their member bindings via a POST request. The flaw (CWE-862) bypasses ntopng's capability-based access control model, enabling non-administrator accounts to eliminate traffic policy segmentation, rate-limit assignments, and visibility restrictions that network security teams depend on. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid ntopng user account with at least low-privilege authentication (PR:L); administrator credentials are not needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L reflects a medium-high integrity threat requiring only low-privilege authentication with no attack complexity barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ntopng to version 6.7.260717 or later, which incorporates commit 7d830f31 adding the missing `auth.has_capability(auth.capabilities.pools)` check before the bulk-delete handler executes, as well as equivalent fixes for the endpoints and recipients delete handlers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all ntopng deployments and document their current versions to determine exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlle
In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/
In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_in
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 al
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authenticati
ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello. Rated high severity (CVSS 8.8), this vulner
An issue was discovered in ntopng 3.4 before 3.4.180617. Rated high severity (CVSS 8.1), this vulnerability is remotely
In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protoc
In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positione
ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the u
In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-aft
In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. Rated critical severity (CV
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today