CVE-2022-46169 is a critical vulnerability identified in Cacti versions 1.2.22 and earlier. This flaw permits unauthenticated remote code execution, posing a significant risk to affected systems.
The vulnerability can be exploited by sending a specially crafted HTTP request to the `remote_agent.php` file. Attackers can bypass authentication using a forged `X-Forwarded-For` header, enabling them to execute commands remotely.
The issue arises from improper handling of the `poller_id` parameter, which allows for command injection. Any Cacti installation accessible over the internet is susceptible to this vulnerability.
CVE-2022-46169 was disclosed on December 5, 2022, and subsequently added to the CISA Known Exploited Vulnerabilities (KEV) list on February 16, 2023. A proof-of-concept was released shortly after the vulnerability's disclosure.
The vulnerability has been actively exploited since early 2023, emphasizing the urgency for organizations to apply patches to protect their systems. Security experts urge affected entities to take immediate action to mitigate this threat.