CVE-2020-8813: Cacti graph_realtime.php OS command injection via cookie

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote OS command execution with a very high EPSS score and public exploit code, though exploitation requires a guest account holding the graph real-time privilege.

What it is

graph_realtime.php in Cacti 1.2.8 passes cookie data into a shell command without sanitization, allowing OS command injection through shell metacharacters. It matters because the vulnerable endpoint is reachable remotely and can yield full command execution on the Cacti host.

Impact

An attacker gains arbitrary OS command execution with the privileges of the web server process, enabling data theft, lateral movement or full host compromise.

Attack surface

Reached over the network via HTTP requests to graph_realtime.php; the CVSS vector indicates low privileges are required, and the description conditions exploitation on a guest user holding the graph real-time privilege. No user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.73779, 99.45th percentile) and multiple references are tagged Exploit, including public unauthenticated and authenticated RCE write-ups.

What to do

• Upgrade Cacti to a release after 1.2.8 that fixes the command injection in graph_realtime.php
• Apply vendor patches for downstream packages (Debian, Fedora, openSUSE, Gentoo) where Cacti is bundled
• Remove the graph real-time privilege from guest accounts and restrict the endpoint to trusted users
• Place the Cacti web interface behind authentication and network access controls so it is not internet-exposed
• Audit and harden the web server account permissions to limit the impact of command execution

Detection

• Monitor web server and application logs for requests to graph_realtime.php containing shell metacharacters in Cookie headers
• Alert on unexpected child processes spawned by the web server user (e.g. sh, bash, curl, wget)
• Inspect outbound network connections originating from the Cacti host for signs of post-exploitation
• Review Cacti guest accounts and privilege assignments for unexpected graph real-time access

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.