PT-2025-1312 · Cacti · Cacti

Chutchut · Published 2025-01-26 · Updated 2026-03-09 · CVE-2025-24367

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.29 Cacti versions 1.2.16+ds1-2+deb11u5 through 1.2.24+ds1-1+deb12u5

Description Cacti is an open source performance and fault management framework. An authenticated user can misuse the graph creation and graph template functionality to create arbitrary PHP scripts within the web root directory of the application, potentially leading to remote code execution on the server. The issue stems from improper handling of line separators.

Recommendations Upgrade Cacti to version 1.2.29 or later. Upgrade Cacti to version 1.2.16+ds1-2+deb11u5 or later for Debian 11 bullseye. Upgrade Cacti to version 1.2.24+ds1-1+deb12u5 or later for Debian bookworm.

Exploit

Fix

RCE

Weakness Enumeration

CWE-144

CWE-20

Related Identifiers

BDU:2025-00974

CVE-2025-24367

DLA-4048-1

DSA-5862-1

GHSA-FXRQ-FR7H-9RQQ

Affected Products

Cacti

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24367.json · Exploit
• 🔥 https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq · Exploit
• https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0 · Patch
• https://osv.dev/vulnerability/CVE-2025-24367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24367 · Security Note
• https://ubuntu.com/security/CVE-2025-24367 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-24367 · Security Note
• https://bdu.fstec.ru/vul/2025-00974 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-24367 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-24367 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5862-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-24367 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4048-1 · Vendor Advisory
• https://t.me/cvedetector/16486 · Telegram Post
• https://t.me/CSIRT_italia/3236 · Telegram Post