CVE-2026-82413

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260717

Description An issue exists where specific endpoints accept the scan ports variable from any authenticated session, including non-administrator users, or without authentication if login is disabled. The endpoints 'scripts/lua/rest/v2/add/host/to scan.lua' and 'scripts/lua/rest/v2/exec/host/schedule vulnerability scan.lua' use a validation function validateSingleWord() that permits shell metacharacters. This value is later concatenated into an nmap command via the nmap scan host() function and executed through ntop.execCmd() or ntop.execCmdAsync() using popen. For the tcp portscan and cve modules, a preliminary nmap -sn probe must report the target as up. If nmap is installed, this allows for command injection, enabling arbitrary operating-system commands to execute as the ntopng service account without further user interaction.

Recommendations Update to version 6.7.260717.