Pierluigi Paganini January 14, 2023

Most internet-exposed Cacti servers are vulnerable to the critical vulnerability CVE-2022-46169 which is actively exploited in the wild.

Cacti is an open-source platform that provides a robust and extensible operational monitoring and fault management framework for users.

Researchers from Censys discovered that the majority of internet-exposed Cacti servers are vulnerable to the critical flaw CVE-2022-46169 which is under active exploitation in the wild.

The flaw is a command injection vulnerability that can be exploited by an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The flaw resides in the `remote_agent.php` file that can be accessed by any unauthenticated user. The vulnerability affects versions 1.2.22 and below.

“A command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device.” reads the advisory.

The researcher noticed that most of the Cacti servers are running outdated versions, with only 26 servers are running a patched version of Cacti (1.2.23 and 1.3.0).

Most hosts running Cacti are in Brazil (20.54%), followed by Indonesia (12.37%) and the United States (3.95%).

The vulnerability was discovered by Sonarsource researchers, who provided details about the issue and published a video PoC demonstrating the exploitation of a server running a vulnerable version of Cacti:

Shadowserver researchers reported that threat actors are actively exploiting the issue since January 3rd, 2023, in some attacks attackers triggered the issue to deploy malware on the vulnerable hosts.

GreyNoise experts also observed attacks in the wild exploiting the flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2022-46169)

[adrotate banner=”5″]

[adrotate banner=”13″]