CVE-2026-82413: ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept scanports from any authenticated session, including non-administrator users, while deployments with login disabled expose the same request without authentication. The endpoints validate scanports with validateSingleWord, which permits shell metacharacters, and persist the value for the minute vulnerability-scan scheduler. The scheduler concatenates the value into an nmap command through nmapscanhost and executes it through ntop.execCmd or ntop.execCmdAsync using popen. For the tcpportscan and cve modules, a preliminary nmap -sn probe must first report the target as up before the attacker-controlled ports are used. When nmap is installed, this command injection allows arbitrary operating-system commands to execute as the ntopng service account without further user interaction. This issue is fixed in version 6.7.260717.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ntopngto a version that resolves this vulnerability.Fixed in 6.7.260717
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Deployments with ntopng login disabled expose the vulnerable request without authentication. Where login is enabled, any authenticated user, including a non-administrator user, can submit the malicious scan_ports value.
What conditions are needed for command execution?
nmap must be installed, and commands execute as the ntopng service account. For the tcp_portscan and cve scan modules, the target must first respond as up to a preliminary nmap -sn probe before the attacker-controlled port argument is used.
What is the immediate remediation?
Upgrade ntopng to version 6.7.260717, which fixes the issue. The provided data does not identify a separate configuration-only mitigation.
How can defenders determine whether their instance may be vulnerable?
Instances running a version prior to 6.7.260717 are affected. Exposure is especially urgent if login is disabled, or if non-administrator accounts can access the vulnerability-scan endpoints and nmap is installed.