CVE-2024-29895

Deeper analysis

Cacti, an operational monitoring and fault management framework, contains a command injection vulnerability in its 1.3.x development branch. The flaw resides in cmd_realtime.php at line 119, where the $poller_id variable incorporated into a command string is taken directly from $_SERVER['argv']. This input can be supplied via the URL when the PHP register_argc_argv directive is enabled, a setting that is on by default in many environments including the official PHP Docker image.

Any unauthenticated remote attacker can therefore supply a crafted request that results in arbitrary command execution on the server with the privileges of the web server process. Successful exploitation yields full control over the monitored system, including the ability to read, modify, or delete data and to pivot further into the environment.

The GitHub Security Advisory GHSA-cr28-x256-xf5m and associated commits document the issue; commit 53e8014d1f082034e0646edc6286cde3800c683d introduced a fix that was later reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc, leaving the development branch exposed.

The vulnerability carries a CVSS score of 10.0 and an EPSS score that has reached 0.93, indicating substantial exploitation interest following disclosure.