CVE-2024-29895

What it actually does

This is an unauthenticated remote command injection in the Cacti 1.3.x development branch affecting cmd_realtime.php when PHP register_argc_argv is enabled. The vulnerable code derives a poller identifier from $_SERVER['argv'], which can be influenced through the URL in affected PHP configurations, and then incorporates that value into an operating-system command. Because the attacker-controlled value is not safely constrained before command execution, a remote attacker can inject shell metacharacters and execute arbitrary commands as the web server user. The vulnerability has network attack vector, requires no credentials or user interaction, and can result in full confidentiality, integrity, and availability compromise of the Cacti host and any monitored credentials or network paths reachable from it.

Why it matters to the business

A successful exploit can turn an internet-accessible Cacti monitoring server into an attacker-controlled foothold. Because monitoring platforms often have broad visibility, stored credentials, SNMP/API access, and trusted network reach, compromise can lead to theft of infrastructure data, disruption of monitoring and alerting, lateral movement, service outages, and incident response blind spots. The very high EPSS score and weaponized exploit maturity indicate a high likelihood of opportunistic scanning and exploitation even though this is not currently listed in CISA KEV. Organizations using the Cacti 1.3.x development branch or containerized PHP environments where register_argc_argv is enabled should treat exposure as urgent.

How an attack unfolds

An attacker first identifies a reachable Cacti instance, typically by probing common Cacti paths and confirming access to cmd_realtime.php. If the deployment is running the affected 1.3.x development branch and PHP has register_argc_argv enabled, the attacker crafts a URL whose query string influences PHP's argv handling. The injected value reaches the poller_id variable and is concatenated into a command executed by the server. The attacker then uses shell metacharacters to append an operating-system command, commonly starting with low-noise reconnaissance such as user, process, or network checks. If command execution succeeds, the attacker may download a web shell or implant, establish reverse connectivity, dump Cacti configuration and database credentials, access monitoring secrets, pivot to managed systems, or disable/alter monitoring to hide follow-on activity.

How to fix it

Upgrade away from the vulnerable Cacti 1.3.x development branch to code that includes the fix from commit 53e8014d1f082034e0646edc6286cde3800c683d and verify that the fix has not been removed by later local changes or by the reverting commit 99633903cad0de5ace636249de16f77e57a3c8fc. Prefer a supported stable Cacti release rather than a development branch for production use. As an immediate mitigation, set PHP register_argc_argv = Off for the Cacti runtime, restart the relevant web/PHP services, and verify the effective setting using the same SAPI used by the web application. Restrict access to the Cacti web interface and especially cmd_realtime.php behind VPN, SSO, IP allowlisting, or administrative network controls. Apply least privilege to the web server account, rotate Cacti database and monitoring credentials if exploitation is suspected, and review outbound egress controls to limit payload staging and reverse shells.

How to confirm the fix worked

Confirm the deployed Cacti code is not the vulnerable 1.3.x development branch and that the patched logic from commit 53e8014d1f082034e0646edc6286cde3800c683d is present. Review local Git history or package provenance to ensure the patch was not reverted by commit 99633903cad0de5ace636249de16f77e57a3c8fc or equivalent downstream changes. Validate the effective PHP configuration for the web runtime, not only CLI PHP, and confirm register_argc_argv is Off where Cacti is served. Check that unauthenticated access to cmd_realtime.php is blocked or constrained as expected. In a controlled test environment, send a harmless request containing shell metacharacters to cmd_realtime.php and verify it is rejected, sanitized, logged as invalid input, or otherwise does not result in command execution, process creation, or abnormal application errors. Review web server, PHP-FPM, container, and host telemetry for historical requests to cmd_realtime.php before considering the issue fully remediated.

Typical attack path

1. Scan for externally reachable Cacti web interfaces and exposed cmd_realtime.php paths.
2. Fingerprint the application branch/version and infer whether the target may be running the vulnerable 1.3.x development code.
3. Determine whether PHP behavior is compatible with exploitation, especially whether register_argc_argv is enabled.
4. Send a crafted unauthenticated request to cmd_realtime.php with attacker-controlled argv/query content containing shell metacharacters.
5. Execute a benign command to confirm code execution, then run reconnaissance commands under the web server account.
6. Download or stage additional tooling, web shells, or reverse shell payloads if outbound network access is available.
7. Read Cacti configuration files and database credentials to obtain monitoring secrets and infrastructure information.
8. Use the compromised monitoring host as a pivot point for lateral movement, credential theft, persistence, or disruption of monitoring services.

How to detect it

Investigate web server access logs, reverse proxy logs, WAF logs, PHP-FPM logs, application logs, container logs, EDR process telemetry, shell history for the web server account, and outbound network telemetry. Focus on unauthenticated or unusual requests to cmd_realtime.php, especially query strings containing shell metacharacters, URL-encoded separators, command substitution syntax, command interpreters, download tools, or temporary file paths. Correlate suspicious requests with child processes spawned by the web server or PHP runtime, such as sh, bash, curl, wget, python, perl, nc, ncat, busybox, or chmod. Review creation or modification of files in web-writable directories and temporary paths around the request time. Look for outbound connections immediately after suspicious requests, particularly to uncommon IPs, high ports, paste sites, file-sharing services, or attacker-controlled infrastructure. If Cacti configuration or database credentials may have been accessed, review database logs and authentication logs for unusual reads or follow-on access from the monitoring host. Absence from CISA KEV should not be treated as absence of exploitation risk because the exploit is weaponized and the EPSS score is very high.

• /cmd_realtime.php
• cmd_realtime.php?
• cmd_realtime.php%3F
• register_argc_argv
• %3B
• %7C
• %26
• %60
• %24%28
• ;id
• ;whoami
• ;uname
• /bin/sh
• /bin/bash
• bash -c
• sh -c
• curl
• wget
• chmod +x
• /tmp/
• /var/tmp/
• nc
• ncat
• busybox
• python -c
• perl -e
• php -r
• cmd_realtime.php?*%3B*
• cmd_realtime.php?*%7C*
• cmd_realtime.php?*%26*
• cmd_realtime.php?*%60*
• cmd_realtime.php?*%24%28*

What your security team should do

• Immediately inventory all Cacti deployments, including containers and development-branch installations, and identify any running 1.3.x DEV code.
• Prioritize internet-facing or broadly reachable Cacti instances for emergency upgrade or isolation because exploitation is unauthenticated and weaponized.
• Apply the fixed Cacti code containing commit 53e8014d1f082034e0646edc6286cde3800c683d, and verify the patch has not been reverted by later changes.
• Disable PHP register_argc_argv for the Cacti web runtime and restart PHP-FPM/Apache/container services to ensure the setting takes effect.
• Temporarily block or tightly restrict access to cmd_realtime.php and the Cacti administrative interface until patching is confirmed.
• Search web access logs, PHP logs, process execution telemetry, EDR data, and network egress logs for suspicious cmd_realtime.php requests and post-exploitation activity.
• If suspicious activity is found, rotate Cacti database credentials, SNMP communities, API tokens, SSH keys, and any monitoring credentials stored or reachable by Cacti.
• Add SIEM detections for cmd_realtime.php requests containing encoded or literal shell metacharacters, command interpreters, download utilities, or references to temporary staging directories.
• Harden the monitoring host with least-privilege service accounts, outbound egress filtering, file integrity monitoring, and restricted administrative access.
• Avoid running development branches of infrastructure monitoring software in production unless a formal compensating-control and patch-monitoring process exists.