PT-2025-1313 · Cacti+1 · Cacti+1

Lorexxar · Published 2025-01-26 · Updated 2025-04-17 · CVE-2024-54145

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.29

Description Cacti is an open source performance and fault management framework. It has a SQL injection vulnerability in the get discovery results function of automation devices.php using the network parameter. This vulnerability may allow a remote attacker to execute arbitrary code.

Recommendations For versions prior to 1.2.29, update to version 1.2.29 or later to resolve the issue. As a temporary workaround, consider restricting access to the automation devices.php file or disabling the get discovery results function until a patch is available. Avoid using the network parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2025-3834

ALT-PU-2025-5333

BDU:2025-00976

CVE-2024-54145

DLA-4048-1

DSA-5862-1

GHSA-FH3X-69RR-QQPP

Affected Products

Alt Linux

Cacti

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54145.json · Exploit
• https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0 · Patch
• https://github.com/Cacti/cacti/security/advisories/GHSA-fh3x-69rr-qqpp · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-54145 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-54145 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-54145 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-54145 · Security Note
• https://bdu.fstec.ru/vul/2025-00976 · Security Note
• https://osv.dev/vulnerability/DSA-5862-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-54145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54145 · Security Note
• https://osv.dev/vulnerability/DLA-4048-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-54145 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html · Note
• https://twitter.com/CVEnew/status/1883930444657287544 · Twitter Post