CVE-2024-25641
Cacti
CVE-2024-25641 in Cacti allows authenticated users with "Import Templates" permission to execute arbitrary PHP code. This arbitrary file write vulnerability is triggered through the "Package Import" feature, enabling malicious PHP code execution.
The vulnerability exists in the import_package() function within /lib/import.php, where filenames and content from XML data are blindly trusted, potentially writing or overwriting critical files. Although the CVSS score is 9.1, the SOCRadar Vulnerability Risk Score (SVRS) is 60, suggesting a moderate level of risk, though active exploits are available. While not critical based on SVRS alone, organizations should prioritize patching to version 1.2.27 given that active exploits exist "In The Wild." This vulnerability is significant because successful exploitation can lead to complete compromise of the Cacti system and the underlying web server. This highlights the importance of patching promptly to avoid potential security breaches.
Description
CVE-2024-25641 is a vulnerability with a CVSS score of 0, indicating a low severity. However, SOCRadar's SVRS assigns it a score of 30, highlighting the potential for exploitation. This discrepancy stems from SOCRadar's integration of additional intelligence sources, including social media, news, and dark web data.
Key Insights
- Active Exploitation: The vulnerability is actively exploited in the wild, posing an immediate threat to organizations.
- Low CVSS Score: The CVSS score of 0 may underestimate the severity of the vulnerability, as it does not consider the broader context and intelligence gathered by SOCRadar.
- SVRS Score of 30: The SVRS score of 30 indicates a moderate level of risk, warranting attention and prompt mitigation.
- Threat Actors: Specific threat actors or APT groups exploiting this vulnerability have not been identified at this time.
Mitigation Strategies
- Apply Software Updates: Install the latest software updates and patches to address the vulnerability.
- Enable Intrusion Detection Systems (IDS): Implement IDS to detect and block malicious activity targeting the vulnerability.
- Restrict Network Access: Limit access to vulnerable systems and services to reduce the attack surface.
- Educate Users: Train users on security best practices and the importance of reporting suspicious activity.
Additional Information
- The Cybersecurity and Infrastructure Security Agency (CISA) has not yet issued a warning for this vulnerability.
- Users with additional queries can utilize the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for further assistance.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.