{"id":"CVE-2024-29895","aliases":["EUVD-2024-26876","GHSA-cr28-x256-xf5m","UBUNTU-CVE-2024-29895"],"status":"published","title":"Cacti command injection in cmd_realtime.php","description":"Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.98826,"percentile":0.99927,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2024-05-13T14:33:27Z","modified":"2026-11-04T20:02:32Z","exploits":[{"source":"pocgithub","id":"Stuub/CVE-2024-29895-CactiRCE-PoC","title":"Stuub/CVE-2024-29895-CactiRCE-PoC","date":"2024-05-15","url":"https://github.com/Stuub/CVE-2024-29895-CactiRCE-PoC"},{"source":"pocgithub","id":"secunnix/CVE-2024-29895","title":"secunnix/CVE-2024-29895","date":"2024-05-16","url":"https://github.com/secunnix/CVE-2024-29895"},{"source":"pocgithub","id":"ticofookfook/CVE-2024-29895.py","title":"ticofookfook/CVE-2024-29895.py","date":"2024-05-16","url":"https://github.com/ticofookfook/CVE-2024-29895.py"},{"source":"nuclei","id":"CVE-2024-29895","title":"Cacti cmd_realtime.php - Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29895.yaml"}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.18+ds1-1","1.1.27+ds1-2","1.1.27+ds1-3","1.1.28+ds1-2","1.1.35+ds1-1","1.1.36+ds1-1","1.1.38+ds1-1","1.1.38+ds1-1ubuntu0.1~esm1","1.1.38+ds1-1ubuntu0.1~esm3","1.1.38+ds1-1ubuntu0.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.4+ds1-2ubuntu3","1.2.9+ds1-1ubuntu1","1.2.9+ds1-1ubuntu2","1.2.10+ds1-1ubuntu1","1.2.10+ds1-1ubuntu1+esm1","1.2.10+ds1-1ubuntu1.1","1.2.10+ds1-1ubuntu1.1+esm1","1.2.10+ds1-1ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.16+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1","1.2.19+ds1-2ubuntu1+esm1","1.2.19+ds1-2ubuntu1.1","1.2.19+ds1-2ubuntu1.1+esm1","1.2.19+ds1-2ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.25+ds1-2","1.2.26+ds1-1","1.2.26+ds1-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.28+ds1-4ubuntu1","1.2.30+ds1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.30+ds1-1ubuntu2","1.2.30+ds1-1ubuntu3","1.2.31+ds1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cacti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.30+ds1-1ubuntu1","1.2.30+ds1-1ubuntu2"]}],"products":[{"vendor":"cacti","product":"cacti"}],"references":[{"url":"https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m","tags":["x_refsource_CONFIRM","x_transferred","advisory","report"]},{"url":"https://github.com/Cacti/cacti/commit/53e8014d1f082034e0646edc6286cde3800c683d","tags":["x_refsource_MISC","x_transferred","fix","report"]},{"url":"https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249de16f77e57a3c8fc","tags":["x_refsource_MISC","x_transferred","fix","report"]},{"url":"https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/cmd_realtime.php#L119","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29895.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29895","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-29895","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29895","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-29895","title":"Cacti command injection in cmd_realtime.php","description":"Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.","status":"published","published":"2024-05-13T14:33:27.594Z","modified":"2024-08-02T01:17:58.192Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-26876","description":"Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.","status":"published","published":"2024-05-13T14:33:27Z","modified":"2024-08-02T01:17:58Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:50:25.628684Z"}],"nvd":[{"id":"CVE-2024-29895","description":"Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.","status":"published","published":"2024-05-14T15:17:15.593Z","modified":"2026-06-17T07:23:19.417Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:57.497105Z"}],"osv":[{"id":"CVE-2024-29895","title":"Cacti command injection in cmd_realtime.php","description":"Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.","status":"published","published":"2024-05-13T14:33:27.594Z","modified":"2026-10-28T02:30:50.259472964Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"UBUNTU-CVE-2024-29895","description":"Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.","status":"published","published":"2024-05-14T15:17:00Z","modified":"2026-11-04T20:02:32.144532832Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T14:22:53.66237Z"}]}}