CVE-2026-82412 in ntopng
Summary
by MITRE • 09/21/2026
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng's CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user's browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within ntopng versions prior to 6.7.260717 represents a critical security flaw involving command injection and insufficient access control mechanisms. As a web-based network traffic monitoring application, ntopng provides administrative interfaces for managing network scans. However, the specific endpoints responsible for adding hosts to scan schedules and executing vulnerability scans contain logic errors that allow unprivileged users to escalate their privileges significantly. The core technical issue lies in how these endpoints handle user-supplied input, specifically the scan_ports parameter. This parameter is processed through a validation function named validateSingleWord which fails to adequately sanitize shell metacharacters before being used in subsequent operations.
The operational impact of this flaw is severe because it enables remote code execution on the underlying operating system. The unsanitized scan_ports value is directly concatenated into an nmap command string within the vs_utils.lua module's nmap_scan_host function. This constructed command is then executed using functions such as ntop.execCmd, ntop.execCmdAsync, or popen. Since these execution methods run with the privileges of the ntopng process account, any authenticated user who can supply malicious input to the scan_ports parameter gains the ability to execute arbitrary operating-system commands under that same high-privilege context. This effectively bypasses the intended role-based access control model by allowing non-administrative users to perform actions reserved for administrators and system operators.
Furthermore, the vulnerability is exacerbated by a cross-site request forgery vector due to inconsistent HTTP method handling in ntopng's security controls. The vulnerable endpoints accept GET requests, which do not carry body data where CSRF tokens are typically validated. Meanwhile, ntopng’s anti-CSRF protections only apply to POST request bodies. This architectural inconsistency allows an attacker to craft a simple URL containing malicious payload parameters and trick a logged-in administrator or privileged user into visiting it via their browser. Upon loading the page, the browser automatically sends the GET request with the victim's session cookies, triggering the command injection without requiring the attacker to possess valid ntopng credentials directly. This combination of input validation failure and CSRF bypass creates a high-severity risk where any authenticated user can potentially compromise the entire host running ntopng.
From an industry standards perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The lack of proper input sanitization allows special characters to alter the intended command structure. Additionally, it relates to CWE-269 Improvement Control and CWE-352 Cross-Site Request Forgery due to the failure to enforce authentication checks on state-changing GET requests or validate CSRF tokens for all relevant endpoints. In terms of MITRE ATT&CK mapping, this scenario corresponds to T1059 Command and Scripting Interpreter where an adversary uses system commands to execute actions, and potentially T1556 Cross-Site Request Forgery if the attack relies on tricking a user into initiating the request.
To mitigate this vulnerability, organizations must immediately upgrade ntopng to version 6.7.260717 or later where these issues have been addressed. The fix involves implementing stricter input validation that rejects shell metacharacters in the scan_ports parameter and ensuring that all endpoints performing state-changing operations enforce CSRF token verification regardless of whether they use GET or POST methods. Administrators should also review their network segmentation to ensure that ntopng instances are not exposed directly to untrusted networks without proper authentication gateways, although upgrading remains the primary remediation step for this specific code-level flaw.