CVE-2024-34340

What it actually does

The compat_password_verify function performs a loose equality comparison ($md5 == $hash) between an MD5 hash of user-supplied input and the stored password hash, enabling type juggling that can authenticate an attacker without the correct password.

Why it matters to the business

Attackers can gain unauthorized access to the monitoring platform, exposing operational data, network topology, and device credentials while bypassing all authentication controls.

How an attack unfolds

An unauthenticated attacker submits a crafted password value during login; the server computes its MD5 and compares it loosely to the database hash; type juggling causes the comparison to succeed, granting a valid session without knowledge of the real password.

How to fix it

Upgrade Cacti to version 1.2.27 or later; on Debian 11 apply the fixed package version 5.10.191-1 for the affected component.

How to confirm the fix worked

Confirm the installed Cacti version is 1.2.27 or newer; verify that password verification logic uses strict comparison (===) or modern password_hash/password_verify functions.

Typical attack path

1. Identify a Cacti login endpoint
2. Craft a password input that triggers MD5 type juggling against the stored hash
3. Submit the value via the authentication form
4. Obtain a valid authenticated session
5. Access or modify monitoring data and device configurations

How to detect it

Review web server and application logs for successful authentication events without corresponding failed attempts or from unexpected source IPs; look for login requests containing numeric or specially formatted password fields around the time of the vulnerability disclosure.

What your security team should do

• Immediately upgrade all Cacti instances to the fixed version
• Audit authentication logs for anomalous successful logins prior to the upgrade
• Restrict network access to the Cacti web interface until patched
• Review stored password hashes and consider forcing password resets after remediation