CVE-2025-66399: SNMP Command Injection leads to RCE in Cacti
Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66399?
CVE-2025-66399 is classified as a medium severity vulnerability due to its potential impact on SNMP device configurations.
How do I fix CVE-2025-66399?
To mitigate CVE-2025-66399, upgrade to Cacti version 1.2.29 or later where the input-validation flaw has been addressed.
What systems are affected by CVE-2025-66399?
CVE-2025-66399 affects all versions of Cacti prior to 1.2.29, specifically those using the SNMP device configuration functionality.
What type of vulnerability is CVE-2025-66399?
CVE-2025-66399 is an input-validation flaw that can be exploited by authenticated users through inappropriate SNMP community strings.
Can CVE-2025-66399 be exploited remotely?
CVE-2025-66399 requires authentication to exploit, thus it cannot be exploited remotely by unauthenticated users.