Skip to content
OpenAdvisories
High WID-SEC-2025-0190 6 CVEs

Cacti: Mehrere Schwachstellen

Published Jan 26, 2025 · Updated Apr 23, 2026 · Revision 6 · de-DE

Vendor: Debian Vendor: SUSE Product: Linux Product: openSUSE Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cacti ausnutzen, um vertrauliche Informationen preiszugeben, beliebigen Code auszuführen und SQL-Abfragen zu manipulieren.

Product

Cacti ist ein grafisches Frontend zur Visualisierung von statistischen Daten, erfasst durch die Round Robin Database rrdtool.

Vulnerabilities 6

  • Critical 9.1
    CVE-2025-22604 Public exploit

    Cacti has Authenticated RCE via multi-line SNMP responses

    Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of e…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • High 8.7
    CVE-2025-24367 Public exploit EPSS 59%

    Cacti allows Arbitrary File Creation leading to RCE

    Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on t…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • High 7.6
    CVE-2024-54146 EPSS 46%

    Cacti has a SQL Injection vulnerability when view host template

    Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. This vulnerability is fixed in 1.2.29.

    Cacti cacti cacti cacti Debian Ubuntu
  • Medium 6.9
    CVE-2025-24368

    Cacti has a SQL Injection vulnerability when using tree rules through Automation API

    Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, r…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 6.3
    CVE-2024-54145

    Cacti has a SQL Injection vulnerability when request automation devices

    Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the get_discovery_results function of automation_devices.php using the network parameter. This vulnerability is fixed in 1.2.29.

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Medium 6.0
    CVE-2024-45598

    Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path

    Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the `Poller Standard Error Log Path` parameter in either Installation Step 5 or in Configuration->Settings->Paths tab to a local file inside the s…

    Cacti cacti cacti cacti Debian Ubuntu Alpine

Revision history

  1. #6

    Neue Updates von openSUSE aufgenommen

  2. #5

    Neue Updates von openSUSE aufgenommen

  3. #4

    Neue Updates von Debian aufgenommen

  4. #3

    Neue Updates von Debian aufgenommen

  5. #2

    CVE's ergänzt

  6. #1

    Initiale Fassung

References