CVE-2022-46169: Cacti Command Injection Vulnerability

CVE-2022-46169 is a command injection vulnerability in Cacti, the open-source network monitoring and graphing platform. An unauthenticated attacker can exploit it to execute code on the underlying system. This matters because Cacti often sits on management networks with visibility into infrastructure; successful abuse can give an outsider a foothold for further movement or data access without needing valid credentials.

Public detail is limited to the CISA summary and the CWE classification; confirm exact impact, affected releases, and exploitation prerequisites against the vendor advisory before acting.

How it works

The flaw is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). In practice this means user-supplied input is passed into a context where the operating system or a shell interprets it as commands, without adequate sanitization or escaping.

An unauthenticated remote user can craft requests that inject additional commands. Because no authentication is required, the attack surface is any reachable Cacti instance that processes the vulnerable input path. The result is arbitrary code execution under the privileges of the Cacti process or its web-server user. Exact request parameters and payload construction are not provided in the available facts and must be taken from the vendor advisory rather than assumed.

Am I affected? How to find it in your systems

Cacti is typically deployed as a LAMP/LEMP stack application used by network and systems teams for SNMP polling, traffic graphing, and device monitoring. It may run on dedicated monitoring servers, virtual machines, or containers, sometimes exposed to internal management networks or, less commonly, the internet.

• Inventory: Search configuration-management databases, package inventories, container registries, and web-server document roots for “cacti”. Look for the characteristic PHP files and the poller/cron processes that accompany a Cacti install.
• Version check: Record the installed Cacti version (often visible in the web UI footer, package metadata, or CHANGELOG) and compare it directly against the fixed releases listed in the vendor advisory. Do not rely on generic version ranges stated elsewhere.
• Configuration review: Note whether the instance is reachable without authentication from untrusted networks and which user account the web server and poller run as.
• Telemetry signs: Examine web-access logs for anomalous GET/POST parameters containing shell metacharacters, unexpected process-creation events under the Cacti or web-server user, and sudden outbound connections or new scheduled tasks originating from the monitoring host. Correlate with any IDS/IPS alerts for command-injection patterns against Cacti paths.

How to remediate

Apply the vendor-supplied updates as the primary and required action. CISA directs organizations to “Apply updates per vendor instructions.” Obtain the patched release from the official Cacti project channels, test in a non-production environment if possible, then deploy.

• After patching, restart the web server and Cacti poller services and verify the version string reflects the fixed release.
• For this injection class, enforce least privilege: ensure the Cacti process and database user cannot write outside their intended directories or execute arbitrary binaries.
• Review and harden input-handling configuration (if any vendor-provided options exist) and keep the underlying PHP, web-server, and OS packages current so that secondary escape paths are reduced.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Network segmentation: Place Cacti hosts behind management-network ACLs or firewalls that allow access only from trusted administrator subnets; block unauthenticated internet or general-user access.
• Virtual patching / WAF: Deploy a web-application firewall rule set that inspects and blocks requests containing shell metacharacters or known command-injection patterns aimed at Cacti endpoints. Confirm rule efficacy against the vendor’s description of the vulnerable path.
• Feature disablement: If the specific input vector can be identified from the advisory, temporarily disable or restrict the affected poller, graph, or remote-agent functionality.
• Heightened monitoring: Enable detailed web and process-creation logging; alert on any command execution or unexpected child processes under the Cacti service account. Retain logs for later forensic review.

If your data may have been exposed

Actively exploited command-injection flaws of this type frequently lead to full system compromise and subsequent data theft or lateral movement. Known ransomware use is not documented for this CVE, yet the unauthenticated code-execution capability still warrants treating any internet-reachable or poorly segmented instance as potentially breached. Review system and network logs for signs of post-exploitation activity, rotate credentials that may have been present on the host, and consider a free exposure scan of organizational email addresses against known breach data sets to determine whether related credentials have already appeared in public dumps.