CVE-2025-66399 SNMP Command Injection leads to RCE in Cacti

High 7.4 Published 2 Dec 2025 Updated 8 Dec 2025

An authenticated user can inject commands via crafted SNMP community strings, leading to remote code execution on the Cacti server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-66399?

CVE-2025-66399 is a high-severity command injection vulnerability in Cacti Cacti, published on 2 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.

Weakness: CWE-77

Which versions are affected by CVE-2025-66399?

It affects 1 product.

Products include Cacti Cacti.

How do I fix CVE-2025-66399?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-66399 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66399 exists.

All Cacti Cacti vulnerabilities

Sources

Also known as DEBIAN-CVE-2025-66399, GHSA-c7rr-2h93-7gjf, UBUNTU-CVE-2025-66399.