Read the docs
TI-2026-56823 Aliases CVE-2026-82412

ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng's CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user's browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0065 51st percentileScored 2026-11-07
Fix Fixed ntopng (ntop): 6.7.260717

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ntopntopngbefore 6.7.2607176.7.260717Patch availableCNA
  • ntopng Vendorntop Affected before 6.7.260717 Fixed in 6.7.260717 Patch available CNA

Remediation

  • Fix · CNA ntopng (ntop) Fixed in 6.7.260717

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82412
  2. 2026-10-16 EPSS moved to the 50th–90th percentile

References

Other 5

  • TI-2026-58397 ntopng: Missing Authorization on System Configuration Backup Download and Listing CVSS 3.1HIGH 8.8
  • TI-2026-58894 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler CVSS 4.0HIGH 7.1
  • TI-2026-58396 ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags CVSS 3.1HIGH 7.1
  • TI-2026-85500 Stack buffer overflow in ntopng nDPI custom category detection CVSS 3.1MEDIUM 5.3
  • TI-2026-28235 ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to… CVSS 3.1CRITICAL 9.8
  • TI-2020-09603 In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer… CVSS 3.1CRITICAL 9.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences