{"id":"CVE-2026-82413","published":"2026-11-05T17:18:21.137","lastModified":"2026-11-05T17:18:21.283","description":"ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated session, including non-administrator users, while deployments with login disabled expose the same request without authentication. The endpoints validate scan_ports with validateSingleWord, which permits shell metacharacters, and persist the value for the minute vulnerability-scan scheduler. The scheduler concatenates the value into an nmap command through nmap_scan_host and executes it through ntop.execCmd or ntop.execCmdAsync using popen. For the tcp_portscan and cve modules, a preliminary nmap -sn probe must first report the target as up before the attacker-controlled ports are used. When nmap is installed, this command injection allows arbitrary operating-system commands to execute as the ntopng service account without further user interaction. This issue is fixed in version 6.7.260717.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-77","CWE-78","CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ntop/ntopng/commit/fda269014c6a8a445c2c893cf9d2fad0128364a5","tags":[]},{"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-9xj6-f266-r46p","tags":[]}],"exploitRefs":[{"url":"https://github.com/ntop/ntopng/commit/fda269014c6a8a445c2c893cf9d2fad0128364a5","tags":[]},{"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-9xj6-f266-r46p","tags":[]}],"hasPoc":true,"ai":{"summary":"The ntopng application before version 6.7.260717 allows authenticated (or unauthenticated if login is disabled) non-administrative users to inject shell metacharacters into the scan_ports parameter, which is later concatenated into an nmap command and executed via popen, leading to arbitrary OS command execution as the ntopng service account.","exploitability":"Exploitation requires either a non-admin authenticated session or access to a deployment with login disabled; the validateSingleWord check permits shell metacharacters, making injection straightforward once the vulnerable endpoints are reachable.","blast_radius":"Successful exploitation grants full OS-level command execution as the ntopng service account, potentially compromising all data accessible to that account and enabling lateral movement within the network.","remediation":"Upgrade to ntopng version 6.7.260717 or later, which fixes the command injection vulnerability by properly sanitizing the scan_ports parameter.","detection":"Look for suspicious entries in ntopng logs showing scheduled vulnerability scans with unexpected shell metacharacters (e.g., semicolons, pipes, backticks) in the scan_ports field, or observe system-level process execution of nmap commands containing non-standard port syntax or appended shell commands. If no such logging occurs, no reliable host or network indicator is derivable from the published description.","tags":["command-injection","rce","auth-bypass","web","ntopng"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:54:01.777Z"}}