PT-2025-48744 · Cacti+1 · Cacti+1

Elhussain Fathy · Published 2025-12-02 · Updated 2026-01-11 · CVE-2025-66399

Positive Technologies · (AI Summary)

CVSS v2.0

9.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.29

Description Cacti is a performance and fault management framework. A flaw exists in the SNMP device configuration functionality due to insufficient input validation. An authenticated Cacti user can provide crafted SNMP community strings containing control characters, which are stored and used in backend SNMP operations. In environments where downstream SNMP tooling interprets these characters as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process.

Recommendations Update to Cacti version 1.2.29 or later.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-15397

CVE-2025-66399

GHSA-C7RR-2H93-7GJF

Affected Products

Cacti

Debian

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66399.json · Exploit
• https://github.com/Cacti/cacti/security/advisories/GHSA-c7rr-2h93-7gjf · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-66399 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66399 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-66399 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-66399 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-66399 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15397 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66399 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-66399 · Security Note
• https://github.com/Cacti/cacti · Note
• https://t.me/pentestingnews/71445 · Telegram Post
• https://t.me/netlas/521 · Telegram Post
• https://twitter.com/CVEnew/status/1995922318057767310 · Twitter Post
• https://twitter.com/Netlas_io/status/1996923096482115709 · Twitter Post