Code Injection in Cacti - CVE-2024-25641
Published: June 3, 2024 / Updated: March 18, 2025
Vulnerability identifier: #VU90703
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-25641
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to execute arbitrary PHP code on the target system.
The vulnerability exists due to improper input validation within the "Package Import" feature. A remote privileged user can send a specially crafted request and execute arbitrary PHP code on the target server.
Affected software
Cacti
Fedora
cacti
cacti-spine
Fedora
cacti
cacti-spine
How to mitigate CVE-2024-25641
Install updates from vendor's website.
Cacti - update to 1.2.27
cacti - addressed in versions 1.2.27-1.el7, 1.2.27-1.el8, 1.2.27-1.el9, 1.2.27-1.fc39
cacti-spine - addressed in versions 1.2.27-1.el7, 1.2.27-1.el8, 1.2.27-1.el9, 1.2.27-1.fc39
cacti - addressed in versions 1.2.27-1.el7, 1.2.27-1.el8, 1.2.27-1.el9, 1.2.27-1.fc39
cacti-spine - addressed in versions 1.2.27-1.el7, 1.2.27-1.el8, 1.2.27-1.el9, 1.2.27-1.fc39
Links to Public Exploits and PoC-codes
- Exploit #11221 - CVE-2024-25641-Exploit-for-Cacti-1.2.26 () (March 18, 2025)
- Exploit #11052 - CVE-2024-25641 (POC exploit for CVE-2024-25641) (January 10, 2025)
- Exploit #10978 - cve-2024-25641-poc (December 13, 2024)
- Exploit #10468 - CVE-2024-25641 (August 30, 2024)
- Exploit #10463 - CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 (August 30, 2024)
- Exploit #10459 - CVE-2024-25641-CACTI-RCE-1.2.26 (August 30, 2024)
- Exploit #10454 - CVE-2024-25641 (August 30, 2024)
- Exploit #9972 - Cacti Import Packages RCE (June 13, 2024)