Unscored severity · published Aug 23, 2013
CVE-2013-1435
(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors
–
CVSS
2.4%
EPSS
No
On KEV
Description
(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
0.8; 0.8.1; 0.8.2; 0.8.2a; 0.8.3; 0.8.3a; +27 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1435
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1435
forums.cacti.net
http://forums.cacti.net/viewtopic.php?f=21&t=50593
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-08/msg00053.html
secunia.com
http://secunia.com/advisories/54181
Vendor Advisory
http://secunia.com/advisories/54386
svn.cacti.net
http://svn.cacti.net/viewvc?view=rev&revision=7392
Patch
http://svn.cacti.net/viewvc?view=rev&revision=7393
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
10.0
CVE-2024-29895
Cacti command injection in cmd_realtime.php
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php