CVE-2023-39362

Name of the Vulnerable Software and Affected Versions Cacti version 1.2.24

Description The issue is related to insufficient validation of arguments passed to a command in the lib/snmp.php file, allowing an authenticated privileged user to perform command injection and obtain remote code execution on the underlying server under certain conditions. The lib/snmp.php file has a set of functions that accept input variables and place them into an exec call without proper escape or validation.

Recommendations For Cacti version 1.2.24, upgrade to version 1.2.25 to address the issue. As a temporary workaround, consider restricting access to the lib/snmp.php file or disabling the vulnerable functions until a patch is available. Avoid using malicious strings in the SNMP options of a Device to minimize the risk of exploitation.