Unscored severity · published Aug 23, 2010
CVE-2010-1645
Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via…
–
CVSS
2.8%
EPSS
No
On KEV
Description
Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cacti · Cacti
through 0.8.7e; 0.5; 0.6; 0.6.1; 0.6.2; 0.6.3; +31 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1645
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1645
Vendor Advisory
http://secunia.com/advisories/41041
svn.cacti.net
http://svn.cacti.net/viewvc?view=rev&revision=5778
svn.cacti.net
http://svn.cacti.net/viewvc?view=rev&revision=5782
svn.cacti.net
http://svn.cacti.net/viewvc?view=rev&revision=5784
www.bonsai-sec.com
http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php
www.cacti.net
http://www.cacti.net/release_notes_0_8_7f.php
More from Cacti
9.8
CVE-2022-46169
Unauthenticated Command Injection
9.8
CVE-2026-40079
Cacti: Command Injection via escape_command() no-op in RRDtool execution
9.8
CVE-2026-39948
Cacti has SQL Injection via rfilter parameter in RLIKE clauses
9.8
CVE-2026-39955
Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php
9.8
CVE-2026-39938
Cacti: Unauthenticated RCE on Graph Image