CVE-2023-31132 Cacti Privilege Escalation
A low-privileged user on a Windows host can create PHP files in Cacti's web directory to execute code as SYSTEM, escalating privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31132?
CVE-2023-31132 is a high-severity vulnerability in Cacti Cacti, published on 5 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files in a web document directory. The user can then execute the PHP files under the security context of SYSTEM. This allows an attacker to escalate privilege from a normal user account to SYSTEM. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-306
Which versions are affected by CVE-2023-31132?
It affects 1 product.
Products include Cacti Cacti.
How do I fix CVE-2023-31132?
No fix has been published for CVE-2023-31132 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-31132 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-31132 exists.
Other vulnerabilities in Cacti Cacti
- CVE-2022-46169 Cacti Command Injection
- CVE-2026-39893 Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
- CVE-2026-39938 Cacti: Unauthenticated RCE on Graph Image
- CVE-2026-39955 Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
- CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti
Sources
Also known as GHSA-rf5w-pq3f-9876.