CVE-2025-22604

Summary

CVE-2025-22604 is a vulnerability affecting the open source performance and fault management framework, Cacti. The issue lies in the multi-line SNMP result parser, where authenticated users can inject malformed Object Identifiers (OIDs). When these malformed OIDs are processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID is utilized as an array key for executing system commands. Consequently, attackers can exploit this flaw for command execution. This vulnerability has been rectified in Cacti version 1.2.29.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.