CVE-2010-1645

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-08-23 · updated 2026-06-16
Weakness: CWE-20

Description

Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.

Affected products

cacti: through 0.8.7e; 0.5, 0.6, 0.6.1, 0.6.2, 0.6.3, 0.6.4 (+30)

References

http://secunia.com/advisories/41041
http://svn.cacti.net/viewvc?view=rev&revision=5778
http://svn.cacti.net/viewvc?view=rev&revision=5782
http://svn.cacti.net/viewvc?view=rev&revision=5784
http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php
http://www.cacti.net/release_notes_0_8_7f.php
http://www.mandriva.com/security/advisories?name=MDVSA-2010:160
http://www.vupen.com/english/advisories/2010/2132
https://bugzilla.redhat.com/show_bug.cgi?id=609115
https://rhn.redhat.com/errata/RHSA-2010-0635.html
http://secunia.com/advisories/41041
http://svn.cacti.net/viewvc?view=rev&revision=5778

Get alerted when CVE-2010-1645 or the next vulnerability affects your stack