CVE-2023-39362 – This vulnerability allows authenticated privile... (How to Fix)

Q: What is the severity of CVE-2023-39362?

CVE-2023-39362 has a CVSS score of 7.2 (HIGH). This vulnerability allows authenticated privileged users in Cacti 1.2.24 to perform command injection through SNMP device configuration, leading to remote code execution on the underlying server. The issue occurs in lib/snmp.php where user input is passed to exec() without proper validation. Only organizations running vulnerable Cacti versions with privileged authenticated users are affected.

📋 TL;DR

This vulnerability allows authenticated privileged users in Cacti 1.2.24 to perform command injection through SNMP device configuration, leading to remote code execution on the underlying server. The issue occurs in lib/snmp.php where user input is passed to exec() without proper validation. Only organizations running vulnerable Cacti versions with privileged authenticated users are affected.

💻 Affected Systems

Products:

Cacti

Versions: 1.2.24 and earlier

Operating Systems: All platforms running Cacti

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated privileged user access to device configuration

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise with attacker gaining root/system-level access, data exfiltration, lateral movement, and persistent backdoor installation.

🟠

Likely Case

Privileged authenticated user exploits the vulnerability to execute arbitrary commands, potentially compromising the Cacti server and accessing sensitive monitoring data.

🟢

If Mitigated

With proper access controls and network segmentation, impact is limited to the Cacti application server only.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires authenticated privileged user access; public exploit code exists in Packet Storm

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.2.25

Vendor Advisory: https://github.com/Cacti/cacti/security/advisories/GHSA-g6ff-58cj-x3cp

Restart Required: No

Instructions:

1. Backup Cacti configuration and database. 2. Download Cacti 1.2.25 from official repository. 3. Replace existing installation files with new version. 4. Run database upgrade if prompted.

🔧 Temporary Workarounds

No known workarounds

all

Vendor states there are no known workarounds for this vulnerability

🧯 If You Can't Patch

Restrict access to Cacti administration interface to only trusted users and networks
Implement strict privilege separation and limit privileged user accounts to absolute minimum

🔍 How to Verify

Check if Vulnerable:

Check Cacti version in web interface or examine include/global.php for version number

Check Version:

grep '\$config\["cacti_version"\]' include/global.php

Verify Fix Applied:

Verify version is 1.2.25 or later and test SNMP device configuration functionality

📡 Detection & Monitoring

Log Indicators:

Unusual exec() calls from Cacti processes
Suspicious commands in Cacti logs related to SNMP configuration
Multiple failed authentication attempts followed by successful privileged login

Network Indicators:

Unexpected outbound connections from Cacti server
Unusual SNMP traffic patterns

SIEM Query:

source="cacti.log" AND ("exec" OR "system" OR "shell_exec") AND NOT expected_command

📊 Metadata

CVE ID: CVE-2023-39362

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: September 5, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-39362, you might also want to check these: