← Vulnerability feed

Vulnerability record · CVE-2021-40643 · published 30 June 2022

CVE-2021-40643: Eyesofnetwork vulnerability

EEyesofnetwork · Eyesofnetwork

EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application in the "cacti" configuration page (by default/usr/sbin/sendmail) it is possible to execute any command, which will be executed when we make a test of the configuration ("send test mail").

9.8 CVSS 3.1 Critical EPSS 2.9% · top 13.6%
9.8CVSS 3.1 base score, v2 10.0
2.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application in the "cacti" configuration page (by default/usr/sbin/sendmail) it is possible to execute any command, which will be executed when we make a test of the configuration ("send test mail").

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://eyesofnetwork.com Broken Link
https://www.eyesofnetwork.com/en/news/vulnerabilite-cacti PatchVendor Advisory
https://eyesofnetwork.com Broken Link
https://www.eyesofnetwork.com/en/news/vulnerabilite-cacti PatchVendor Advisory

Track CVE-2021-40643 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-8657EyesOfNetwork hardcoded API key allows admin token forgeryEyesOfNetwork 5.3 ships with a hardcoded API key (EONAPI_KEY in include/api_functions.php for API version 2.4.2) that is identical across all install…KEVEPSS 92%analysed7.8CVE-2020-8655EyesOfNetwork sudoers misconfiguration allows apache-to-root privilege escalationEyesOfNetwork 5.3 ships a sudoers configuration that lets the apache user run arbitrary commands as root through a crafted NSE script for nmap 7. Bec…KEVEPSS 60%analysed9.8CVE-2022-41572Eyesofnetwork incorrect default permissions vulnerabilityAn issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server because nmap can be run as root…EPSS 0.59%9.8CVE-2022-41570Eyesofnetwork sql injection vulnerabilityAn issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.EPSS 0.79%9.8CVE-2022-41571Eyesofnetwork vulnerabilityAn issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.EPSS 1.1%9.8CVE-2021-27514Eyesofnetwork improper restriction of authentication attempts vulnerabilityEyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (s…EPSS 3.5%9.8CVE-2020-27886Eyesofnetwork sql injection vulnerabilityAn issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticate…EPSS 1.7%9.8CVE-2020-9465EyesOfNetwork eonweb SQL injection allows unauthenticated auth bypassEyesOfNetwork eonweb versions 5.1 through 5.3 before 5.3-3 contain a SQL injection in the web interface. The user_id field in a cookie is injectable,…EPSS 82%analysed

Source: NIST National Vulnerability Database (record CVE-2021-40643), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.