CVE-2022-46169
Cacti Command Injection Vulnerability
Description
CVE-2022-46169 is a critical command injection vulnerability in Cacti, an open source network monitoring and fault management platform. The flaw allows an unauthenticated remote attacker to execute arbitrary commands on the server by exploiting insufficient input sanitization in the remote_agent.php file, combined with an authentication bypass via spoofed HTTP headers. With a CVSS score of 9.8 and an EPSS score of 94.5% (99.99th percentile), CVE-2022-46169 is among the most actively exploited vulnerabilities tracked by CISA. The vulnerability was patched in Cacti versions 1.2.23 and 1.3.0, and organizations running unpatched instances face immediate risk of full system compromise.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cacti | cacti | < 1.2.23 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/Cacti/cacti/commit/7f0e16312dd5ce20f93744ef8b9c3b0f1ece2216(Patch, Third Party Advisory)
- https://github.com/Cacti/cacti/commit/a8d59e8fa5f0054aa9c6981b1cbe30ef0e2a0ec9(Patch, Third Party Advisory)
- https://github.com/Cacti/cacti/commit/b43f13ae7f1e6bfe4e8e56a80a7cd867cf2db52b(Patch, Third Party Advisory)
- https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf(Exploit, Mitigation, Patch, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-46169(US Government Resource)
Weakness Type
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)
In Cacti, CWE-74 manifests through the remote_agent.php file where user-supplied input — specifically the poller_id parameter — is incorporated into a string passed to proc_open without proper neutralization. The downstream PHP process interpreter executes the injected content as operating system commands, enabling arbitrary command execution.
Learn more: CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
The Cacti vulnerability directly enables OS command injection through the poller_id parameter in the polldata action. Because the parameter is retrieved via get_nfilter_request_var (which allows arbitrary strings) and inserted into a proc_open call, an attacker can append shell commands using separators like semicolons to execute arbitrary operating system commands.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
CWE-863: Incorrect Authorization
The authentication bypass component of CVE-2022-46169 is classified under CWE-863. The get_client_addr function in Cacti trusts HTTP headers (such as Forwarded-For) that can be arbitrarily set by an attacker. By spoofing the IP address of the Cacti server itself, an attacker bypasses the hostname-based authorization check in remote_agent.php, gaining unauthorized access to execute privileged actions.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2022-46169 has a CVSS score of 9.8 (Critical), representing the maximum exploitability profile possible for an unchanged-scope vulnerability. The flaw is remotely exploitable over the network without any requirement for physical or adjacent access. Attack complexity is low — the exploitation path is well-documented and requires no race conditions or special configurations, only that a poller_item with POLLER_ACTION_SCRIPT_PHP action exists (which is common in production Cacti deployments). No authentication is required due to the authorization bypass, and no user interaction is needed, making this vulnerability fully automatable. Confidentiality, integrity, and availability are all rated as High impact, meaning successful exploitation grants complete control over the Cacti server, including the ability to read monitoring data and credentials, modify system configurations, and disrupt monitoring services. The EPSS score of 94.5% (99.99th percentile) confirms near-certain active exploitation, reflecting the ease of exploitation and widespread availability of Cacti instances exposed to the internet.
Exploit Maturity
CVE-2022-46169 has a highly mature exploit landscape with multiple indicators of active, widespread exploitation. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 9, 2023. Public exploit code and a detailed security advisory are available via the Cacti GitHub security advisory (GHSA-6p93-p743-35gf), which includes proof-of-concept details and a thorough technical writeup of the exploitation chain. Multiple patches have been published on GitHub addressing different aspects of the vulnerability. The EPSS score of 94.5% places this vulnerability in the 99.99th percentile, indicating near-certain exploitation activity across the internet. The combination of unauthenticated remote code execution, low complexity, and publicly available exploit details makes CVE-2022-46169 one of the most dangerous vulnerabilities for organizations running exposed Cacti instances.
Remediation
- Upgrade Cacti to version 1.2.23 or later immediately. This is the first release in the 1.2.x branch that contains the complete fix for CVE-2022-46169, addressing both the command injection and the authentication bypass. For organizations on the 1.3.x branch, upgrade to 1.3.0 or later. CISA requires remediation by 2023-03-09.
- Restrict network access to the Cacti web interface. Ensure that remote_agent.php and other Cacti endpoints are not accessible from the public internet. Place Cacti behind a firewall or VPN and limit access to authorized monitoring infrastructure only.
- Disable or restrict the remote agent functionality. If the remote agent feature (remote_agent.php) is not required in your deployment, consider disabling it entirely. If it is needed, implement IP-based access controls at the web server level to restrict which hosts can access this endpoint.
- Harden HTTP header trust settings. Review and configure your web server and Cacti installation to not trust client-supplied HTTP headers (such as X-Forwarded-For, Forwarded-For) for authorization decisions. Ensure that get_client_addr relies only on the actual TCP connection source address.
- Audit systems for indicators of compromise. Review web server access logs for suspicious requests to remote_agent.php, particularly those containing poller_id parameters with shell metacharacters (semicolons, pipes, backticks). Check for unauthorized processes, new user accounts, web shells, or cryptocurrency miners that may indicate prior exploitation.
Technical Details
CVE-2022-46169 combines three distinct weakness types — CWE-74 (Injection), CWE-78 (OS Command Injection), and CWE-863 (Incorrect Authorization) — into a devastating unauthenticated remote code execution chain in Cacti. The attack begins with an authentication bypass: the remote_agent.php file authorizes clients by resolving their IP address to a hostname and checking it against the poller table, but the get_client_addr function in lib/functions.php trusts attacker-controllable HTTP_* server variables (such as Forwarded-For), allowing an attacker to spoof the IP address of the Cacti server itself and pass the authorization check. Once authorized, the attacker triggers the polldata action, which calls poll_for_data and retrieves the poller_id parameter via get_nfilter_request_var — a function that permits arbitrary string values without filtering. This parameter is inserted into a string passed to proc_open when the poller_item action equals POLLER_ACTION_SCRIPT_PHP, creating a direct OS command injection vector. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the trivial exploitability: network-accessible, low complexity, no authentication, no user interaction, and full impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2022-46169 being actively exploited?
Yes, CVE-2022-46169 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 9, 2023. The EPSS score of 94.5% (99.99th percentile) confirms near-certain exploitation activity, and public exploit code is readily available through the Cacti GitHub security advisory.
What products are affected by CVE-2022-46169?
CVE-2022-46169 affects the Cacti open source network monitoring platform. Specifically, all versions prior to 1.2.23 in the 1.2.x branch and all versions prior to 1.3.0 in the 1.3.x branch are vulnerable. The vulnerability requires that at least one poller_item with a POLLER_ACTION_SCRIPT_PHP action type exists, which is common in production Cacti deployments.
How do I fix CVE-2022-46169?
Upgrade Cacti to version 1.2.23 or later (or 1.3.0+ for the 1.3.x branch), which patches both the command injection and the authentication bypass. As immediate mitigations, restrict network access to remote_agent.php and ensure the Cacti web interface is not exposed to the public internet. See the Remediation section for detailed steps.
How severe is CVE-2022-46169?
CVE-2022-46169 is rated Critical with a CVSS score of 9.8 out of 10.0. It allows unauthenticated remote code execution with no user interaction required and low attack complexity. With an EPSS score of 94.5% (99.99th percentile), it is one of the most likely-to-be-exploited vulnerabilities currently tracked, posing an immediate and severe threat to any unpatched Cacti instance accessible over the network.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.