CVE-2023-39362 Authenticated command injection in SNMP options of a Device

High 7.2 Published 5 Sep 2023 Updated 27 Feb 2025

An authenticated privileged user can achieve remote code execution on the server via command injection in SNMP options.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-39362?

CVE-2023-39362 is a high-severity command injection vulnerability in Cacti Cacti, published on 5 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-77, CWE-78

Which versions are affected by CVE-2023-39362?

It affects 2 products.

Products include Cacti Cacti, Fedoraproject Fedora.

How do I fix CVE-2023-39362?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-39362 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39362 exists.

Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.

All Cacti Cacti vulnerabilities

Sources

Also known as CLEANSTART-2024-HF66576, DEBIAN-CVE-2023-39362, GHSA-g6ff-58cj-x3cp, UBUNTU-CVE-2023-39362.