CVE-2009-4112

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by...

9.0 HighPublic exploitFix available

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.

Exploit likelihood

11.5%Up 1.8 points since Feb 4, 2022

What each source reports

NVD Score used 9.0

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.

Record: CVE-2009-4112
CVSS 2.0: 9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.

Record: CVE-2009-4112
Updated: 2026-11-02

EUVDEUVD-2009-4083 No score

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.

Record: EUVD-2009-4083
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p256-rcj4-whc9 No score

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by...

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.

Record: GHSA-p256-rcj4-whc9
Updated: 2026-11-02

OSV No score

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.

Record: CVE-2009-4112
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-4112 No score

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.

Record: DEBIAN-CVE-2009-4112
Updated: 2026-11-02

Show 5 moreShow less

OSVopenSUSE-SU-2020:0272-1 No score

Security update for cacti, cacti-spine

This update for cacti, cacti-spine fixes the following issues:

cacti-spine was updated to version 1.2.9.

Security issues fixed:

CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
CVE-2019-16723: Fixed an authentication bypass vulnerability.
CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).

Non-security issues fixed:

Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).

Record: openSUSE-SU-2020:0272-1
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0284-1 No score

Security update for cacti, cacti-spine

This update for cacti, cacti-spine fixes the following issues:

cacti-spine was updated to version 1.2.9.

Security issues fixed:

CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
CVE-2019-16723: Fixed an authentication bypass vulnerability.
CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).

Non-security issues fixed:

Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record: openSUSE-SU-2020:0284-1
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0558-1 No score

Security update for cacti, cacti-spine

This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:

This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.

Record: openSUSE-SU-2020:0558-1
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0565-1 No score

Security update for cacti, cacti-spine

This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:

This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record: openSUSE-SU-2020:0565-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10670-1 No score

cacti-1.2.18-1.2 on GA media

These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10670-1
Updated: 2026-11-02

Affected products

cacti

Affected packages

Affected packages
Package	Affected	Fixed
`cacti` Debian:12	before 1.2.1+ds1-1	1.2.1+ds1-1
`cacti` Debian:13	before 1.2.1+ds1-1	1.2.1+ds1-1
`cacti` Debian:14	before 1.2.1+ds1-1	1.2.1+ds1-1
`cacti` openSUSE:Leap 15.1 From an advisory covering 10 CVEs	before 1.2.9-lp151.3.3.1	1.2.9-lp151.3.3.1
`cacti-spine` openSUSE:Leap 15.1 From an advisory covering 10 CVEs	before 1.2.9-lp151.3.3.1	1.2.9-lp151.3.3.1
`cacti` SUSE:Package Hub 15 SP1 From an advisory covering 10 CVEs	before 1.2.9-bp151.4.3.1	1.2.9-bp151.4.3.1
`cacti-spine` SUSE:Package Hub 15 SP1 From an advisory covering 10 CVEs	before 1.2.9-bp151.4.3.1	1.2.9-bp151.4.3.1
`cacti` SUSE:Package Hub 12 From an advisory covering 11 CVEs	before 1.2.11-5.1	1.2.11-5.1
`cacti-spine` SUSE:Package Hub 12 From an advisory covering 11 CVEs	before 1.2.11-2.1	1.2.11-2.1
`cacti` openSUSE:Leap 15.1 From an advisory covering 11 CVEs	before 1.2.11-5.1	1.2.11-5.1

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`cacti-spine` openSUSE:Leap 15.1 From an advisory covering 11 CVEs	before 1.2.11-2.1	1.2.11-2.1
`cacti` SUSE:Package Hub 15 SP1 From an advisory covering 11 CVEs	before 1.2.11-bp151.4.6.1	1.2.11-bp151.4.6.1
`cacti-spine` SUSE:Package Hub 15 SP1 From an advisory covering 11 CVEs	before 1.2.11-bp151.4.6.1	1.2.11-bp151.4.6.1
`cacti` openSUSE:Tumbleweed From an advisory covering 31 CVEs	before 1.2.18-1.2	1.2.18-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Joomla! Component ProofReader 1.0 RC9 - Cross-Site Scripting	2009-11-16

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-4112 is a high vulnerability (CVSS 9.0) in Cacti, published November 30, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 11.5%, the 96th percentile. Fixed in cacti 1.2.1+ds1-1.

References

Show 56 moreShow less