CVE-2024-29895: Cacti unauthenticated command injection in the 1.3.x dev branch
The short version: Cacti — an open-source network-monitoring framework — has a command-injection flaw (CVE-2024-29895) that lets an unauthenticated attacker run OS commands on the server when PHP's register_argc_argv is enabled. It scores a perfect 10.0. The important nuance: it affects the 1.3.x development branch, not a stable release — so the practical blast radius is narrow, but if you run that dev code exposed, it's serious. Confirm, then upgrade or take it offline.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — devastating where it applies, but it only applies to the 1.3.x dev branch |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 94.29% · 99.84th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in CISA KEV; a public exploit path exists |
| Vulnerability type | CWE-77 command injection → unauthenticated OS command execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Cacti 1.3.x DEV branch, when PHP register_argc_argv is On (a common default) |
| Fixed in | Patched on the 1.3.x branch (Cacti advisory GHSA-cr28-x256-xf5m) |
What you need to know
CVE-2024-29895 is a command injection. In cmd_realtime.php, the $poller_id value used to build a command is sourced from $_SERVER['argv'] — which an attacker can control via the URL when PHP's register_argc_argv option is On. That option is enabled by default in many environments (including common PHP Docker images), so on an affected install the precondition is often already met, and an unauthenticated request lands as arbitrary OS command execution.
Two things to hold in tension here:
- On paper it's a 10.0 — unauthenticated, network-reachable, scope-changing code execution.
- In reality it's narrow — the vulnerable code is on the 1.3.x development branch, not a stable Cacti release. Most production deployments run a stable version and are not affected.
How serious we see it
High — because the gap between the 10.0 and the real world is the whole story.
We don't rate this Critical, and here's why: a perfect base score describes what happens if you're affected, not how likely that is. This flaw lives in unreleased development code, so the population of exposed systems is small. But for anyone actually running the 1.3.x dev branch on an internet-facing box with the default PHP setting, it is exactly as bad as the score says — unauthenticated RCE. The reassuring part: it's fixable (upgrade off the vulnerable dev code), it's not in KEV, and confirming whether you even run the dev branch is quick.
Recommendations
Straight from Cacti's advisory:
- Confirm your exposure first. Determine whether you run the Cacti 1.3.x development branch at all — stable releases are not affected.
- Upgrade or move off the dev code. Apply the fix from the Cacti advisory (GHSA-cr28-x256-xf5m), or move to a patched build.
- Reduce the precondition. Where feasible, disable PHP
register_argc_argvfor the Cacti install. - Get it off the public internet. A monitoring console rarely needs to face the world — restrict it to trusted networks or a VPN.
- Hunt if it was exposed. Review logs for unexpected process execution and requests to
cmd_realtime.php.
How BreachRisk sees it
BreachRisk discovers internet-facing Cacti instances from little more than your domain and fingerprints the product so you can see, from the outside, whether a monitoring console is exposed at all. For a version-based flaw like this we detect and flag the exposure; we don't exploit it. The value is turning "we think we run Cacti somewhere" into a ranked, external inventory — so a stray dev-branch install doesn't sit forgotten on the internet.