High-Severity Cacti Flaw (CVE-2025-66399) Risks Remote Code Execution via SNMP Community String Injection

A high-severity flaw in Cacti, tracked as CVE-2025-66399, could allow Remote Code Execution by injecting crafted SNMP Community Strings, potentially giving attackers full control of a monitoring server. The weakness lies in how Cacti validates the snmp_community field; the input-validation filter is effectively empty, leaving newline characters unmodified and enabling command-injection-style payloads when downstream SNMP tools interpret newline-separated tokens.

An authenticated Cacti user can store crafted SNMP community strings containing control characters, which are then embedded into backend SNMP operations and may be executed as part of poll processes. A published example shows a multi-line payload being stored and later used in a request that includes a crafted command sequence, potentially resulting in arbitrary command execution with the privileges of the Cacti process.

The development team has released a patch, and administrators are urged to upgrade immediately to version 1.2.29, as noted in the advisory according to GHSA-c7rr-2h93-7gjf. The vulnerability could lead to unauthorized modification of monitoring data, system-level command execution, and even full compromise of the Cacti server.