CVE-2025-66399

Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Cacti/cacti/security/advisories/GHSA-c7rr-2h93-7gjf	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*

History

18 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Cacti es un framework de código abierto para la gestión de rendimiento y fallos. Versiones anteriores a 1.2.29, existe una falla de validación de entrada en la funcionalidad de configuración de dispositivos SNMP. Un usuario autenticado de Cacti puede proporcionar cadenas de comunidad SNMP manipuladas que contienen caracteres de control (incluyendo saltos de línea) que son aceptadas, almacenadas textualmente en la base de datos, y posteriormente incrustadas en operaciones SNMP de backend. En entornos donde las herramientas o wrappers SNMP posteriores interpretan los tokens separados por saltos de línea como límites de comando, esto puede llevar a una ejecución de comandos no intencionada con los privilegios del proceso de Cacti. Esta vulnerabilidad está corregida en 1.2.29.

Information

Published : 2025-12-02 18:15

Updated : 2026-10-18 18:10

NVD link : CVE-2025-66399

Mitre link : CVE-2025-66399

CVE.ORG link : CVE-2025-66399

JSON object : View

Products Affected

cacti

cacti

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-66399", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66399", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-02T18:25:47.603452Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Cacti", "product": "cacti", "versions": [{"status": "affected", "version": "< 1.2.29"}]}]}], "published": "2025-12-02T18:15:49.540", "references": [{"url": "https://github.com/Cacti/cacti/security/advisories/GHSA-c7rr-2h93-7gjf", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29."}, {"lang": "es", "value": "Cacti es un framework de c\u00f3digo abierto para la gesti\u00f3n de rendimiento y fallos. Versiones anteriores a 1.2.29, existe una falla de validaci\u00f3n de entrada en la funcionalidad de configuraci\u00f3n de dispositivos SNMP. Un usuario autenticado de Cacti puede proporcionar cadenas de comunidad SNMP manipuladas que contienen caracteres de control (incluyendo saltos de l\u00ednea) que son aceptadas, almacenadas textualmente en la base de datos, y posteriormente incrustadas en operaciones SNMP de backend. En entornos donde las herramientas o wrappers SNMP posteriores interpretan los tokens separados por saltos de l\u00ednea como l\u00edmites de comando, esto puede llevar a una ejecuci\u00f3n de comandos no intencionada con los privilegios del proceso de Cacti. Esta vulnerabilidad est\u00e1 corregida en 1.2.29."}], "lastModified": "2026-10-18T18:10:00.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cacti:cacti:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0B80A90-97E0-49C0-A780-695E17B0568C", "versionEndExcluding": "1.2.29"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}