Get real-time updates on Telegram
CVE-2025-66399: cacti before 1.2.29 (exclusive), < 1.2.29
CVE-2025-66399. CVSS 3.1 base score 8.8 (HIGH, NVD). EPSS 0.10812 (percentile 0.95808), scored 17-Oct-2026.
Affected technology
cacti · before 1.2.29 (exclusive)
cacti
cacti · < 1.2.29
Cacti
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. Vendor/CNA’s CVSS 4.0 assessment (base score 7.4/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-77
- CCR priority
- 37.9 /100 (P4)
- CVSS 3.1
- 8.8 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · NVD
- EPSS
- 0.10812 · percentile 0.95808 · 2026-10-17
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-18 18:49:36.049749+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-66399.html