CVE-2020-7237

Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.

• CWE-78

• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
• https://ctrsec.io/index.php/2020/01/25/cve-2020-7237-remote-code-execution-in-cacti-rrdtool/Third Party Advisory
• https://github.com/Cacti/cacti/issues/3201Exploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUSOTOIEJKD2IWJHN7TY56TDZJQZJUVJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XLZAMGTW2OSIBLYLXWHQBGWP7M4DTRS7/
• https://security.gentoo.org/glsa/202003-40
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00042.html
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00048.html
• https://ctrsec.io/index.php/2020/01/25/cve-2020-7237-remote-code-execution-in-cacti-rrdtool/Third Party Advisory
• https://github.com/Cacti/cacti/issues/3201Exploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUSOTOIEJKD2IWJHN7TY56TDZJQZJUVJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XLZAMGTW2OSIBLYLXWHQBGWP7M4DTRS7/
• https://security.gentoo.org/glsa/202003-40

Published

Jan 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7231Evoko Home 1.31 devices provide different error messages for…5.3
• CVE-2020-7232Evoko Home devices 1.31 through 1.37 allow remote attackers …7.5
• CVE-2020-7233KMS Controls BAC-A1616BC BACnet devices have a cleartext pas…9.8
• CVE-2020-7234Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS…4.8
• CVE-2020-7235UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS v…6.1
• CVE-2020-7236UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS v…6.1
• CVE-2020-7238Netty 4.1.43.Final allows HTTP Request Smuggling because it …7.5
• CVE-2020-7239The conversation-watson plugin before 0.8.21 for WordPress h…6.1
• CVE-2020-7240Meinberg Lantime M300 and M1000 devices allow attackers (wit…8.8
• CVE-2020-7241The WP Database Backup plugin through 5.5 for WordPress stor…7.5
• CVE-2020-7242Comtech Stampede FX-1010 7.4.3 devices allow remote authenti…7.2
• CVE-2020-7243Comtech Stampede FX-1010 7.4.3 devices allow remote authenti…7.2