A newly disclosed critical security vulnerability in the Cacti open-source network monitoring framework poses a significant risk, enabling authenticated attackers to execute remote code on affected systems.
CVE-2025-22604: High-Risk Exploit with a CVSS Score of 9.1
Tracked as CVE-2025-22604, this flaw has been assigned a CVSS severity score of 9.1 out of 10, indicating a severe risk level.
According to an official advisory, the vulnerability originates from a flaw in the multi-line SNMP result parser, allowing authenticated users to inject malformed Object Identifiers (OIDs) into responses. When these responses are processed by functions such as ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), portions of the OIDs are used as keys in a system command, leading to arbitrary command execution.
Potential Impact: Unauthorized Remote Code Execution
Successful exploitation of CVE-2025-22604 allows attackers with device management permissions to:
Execute arbitrary system commands
Gain unauthorized access to sensitive data
Modify or delete critical files
Affected Versions & Patch Availability
This vulnerability affects all Cacti versions up to and including 1.2.28. To address this security flaw, Cacti has released version 1.2.29, which resolves the issue. Security researcher u32i has been credited with discovering and reporting the flaw.
Additional Security Fix: CVE-2025-24367 (CVSS 7.2)
Alongside CVE-2025-22604, another vulnerability CVE-2025-24367 has been patched in version 1.2.29. This flaw, rated 7.2 on the CVSS scale, allows authenticated attackers to create arbitrary PHP scripts within the web root by abusing graph creation and template functionalities, ultimately leading to remote code execution.
Mitigation: Immediate Patching Recommended
Given Cacti’s history of actively exploited vulnerabilities, organizations relying on the platform for network monitoring must prioritize updating to version 1.2.29 to mitigate the risk of exploitation. Applying the latest security patches is essential to safeguard against potential cyber threats.