ntopng OS command injection via vulnerability-scan scan_ports parameter
Anyone who gets into this network monitor can run commands on the server.
Summary
The scan_ports value in ntopng's vulnerability-scan scheduler is passed unchecked into an nmap command, so it runs. Any logged-in non-admin user can exploit it, and installs with login disabled are exposed without authentication.
Affected when
- nmap installed
- login disabled, or any ordinary account can log in
- tcp_portscan or cve scan module in use
What to do
Update to ntopng 6.7.260717 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen