CVE-2021-40643

CRITICAL

Published Jun 30, 20224y ago · Modified Jun 17, 20261w ago

9.8 CVSS 3.1

Critical

Published Jun 30, 2022 4y ago

Last Modified Jun 17, 2026 1w ago

Description

EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application in the "cacti" configuration page (by default/usr/sbin/sendmail) it is possible to execute any command, which will be executed when we make a test of the configuration ("send test mail").

CVSS Details

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

No Known Exploit

Patch Available

Affected Products 1

Vendor	Product	Version	Range
eyesofnetwork	eyesofnetwork	*	<2021-07-07

References 2

eyesofnetwork.com https://eyesofnetwork.com

Broken Link
eyesofnetwork.com https://www.eyesofnetwork.com/en/news/vulnerabilite-cacti

PatchVendor Advisory

Remediation

eyesofnetwork.com https://www.eyesofnetwork.com/en/news/vulnerabilite-cacti

PatchVendor Advisory