CVE-2021-40643: 
EyesOfNetwork vulnerability analysis and mitigation

EyesOfNetwork before 07-07-2021 contains a Remote Code Execution vulnerability (CVE-2021-40643) in the mail options configuration page. The vulnerability exists in the location of the 'sendmail' application in the 'cacti' configuration page (by default /usr/sbin/sendmail), where it is possible to execute arbitrary commands when testing the configuration through the 'send test mail' function (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v2.0 Base Score of 10.0 HIGH (Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C). The vulnerability allows an attacker to execute arbitrary commands through the sendmail application configuration in the cacti page (NVD).

The vulnerability allows an attacker to execute any command with root privileges on the system without requiring prior authentication or login credentials. This gives complete control over the affected system to the attacker (EyesOfNetwork Advisory).

A patch was released on July 1, 2021, and is available through the EyesOfNetwork repositories. Users should update their systems by executing the command 'yum update cacti0' to apply the fix (EyesOfNetwork Advisory).