[KEV] Vulnerability in Cacti (CVE-2022-46169)
Summary
Vulnerability in Cacti (CVE-2022-46169). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
Original description
The description as published by the source.
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the remote_agent.php file. This file can be accessed without authentication. This function retrieves the IP address of the client via get_client_addr and resolves this IP address to the corresponding hostname via gethostbyaddr. After this, it is verified that an entry within the poller table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns true and the client is authorized. This authorization can be bypassed due to the implementation of the get_client_addr function. The function is defined in the file lib/functions.php and checks serval $_SERVER variables to determine the IP address of the client. The variables beginning with HTTP_ can be arbitrarily set by an attacker. Since there is a default entry in the poller table with the hostname of the server running Cacti, an attacker can bypass the authentication e.g. by providing the header Forwarded-For: . This way the function get_client_addr returns the IP address of the server running Cacti. The following call to gethostbyaddr will resolve this IP address to the hostname of…
Source: CISA Known Exploited Vulnerabilities NVD GitHub Advisory CISA KEV
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2022-46169 has been found in Cacti.
Risk of unauthorized operations or information disclosure.
Note: CISA has officially confirmed this is actively exploited in the wild. Treat it with elevated urgency.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "Cacti CVE-2022-46169" on the vendor's site.
CVE-2022-46169 (Cacti) — CWE-74
Listed in CISA KEV — actively exploited, treat as top priority.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-74) exists in Cacti.
Check the vendor advisory for the affected versions of Cacti.
Severity: High. Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited in the wild, treat as top priority.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Cacti' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'Cacti' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
Cactiを grep し、稼働しているサービス・バージョンを把握する。 -
2Consider incident declaration escalate
Notify SOC / on-callCISA KEV登録済 = 実環境で悪用が観測されている。侵入の兆候があればインシデント対応宣言、無くてもパッチ適用までWAF強化を最優先で。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-46169 cacti Fixed in: 1.2.16+ds1-2+deb11u1
References
- advisory nvd.nist.gov
- advisory github.com
- advisory github.com
- patch github.com
- patch github.com
- patch github.com
- web cisa.gov