Security researchers have discovered critical vulnerabilities in the Cacti open-source network monitoring framework, which could allow authenticated attackers to execute remote code on vulnerable instances. Identified as CVE-2025-22604, this vulnerability has been assigned a CVSS score of 9.1, indicating its high severity. With a flaw rooted in the multi-line SNMP result parser, authenticated users can inject malformed OIDs into the system response. This dangerous security issue affects Cacti versions prior to and including 1.2.28 and has been addressed in version 1.2.29. Exploiting this vulnerability can have serious implications, including unauthorized code execution, data theft, modification, or deletion, posing significant threats to any affected systems.
Another notable flaw, tagged as CVE-2025-24367, carries a CVSS score of 7.2 and enables authenticated attackers to create arbitrary PHP scripts in the web root. This is accomplished through the graph creation and template functionality of Cacti, leading to potential remote code execution. Both vulnerabilities underscore the urgent need for organizations employing Cacti to update their software to the latest version to minimize security risks. The discovery of CVE-2025-22604 is credited to a researcher known as u32i, whose work highlights the importance of continuous vulnerability assessments in open-source software.
Given previous incidents where Cacti’s vulnerabilities were actively exploited, the current flaws emphasize the importance of timely software patches to prevent possible security breaches. Organizations using Cacti should prioritize this update to protect their systems from potential compromise. By quickly applying patches and maintaining vigilant security practices, administrators can mitigate the risks associated with these critical vulnerabilities. Through this urgent reminder, the narrative stresses the essential role of proactive security measures in safeguarding network monitoring systems against evolving threats.