ntop ntopng up to 6.7.260716 Vulnerability-Scan Scheduler to_scan.lua ntop.execCmd scan_ports command injection

Summaryinfo

A vulnerability identified as critical has been detected in ntop ntopng up to 6.7.260716. This impacts the function ntop.execCmd of the file scripts/lua/rest/v2/add/host/to_scan.lua of the component Vulnerability-Scan Scheduler. Performing a manipulation of the argument scan_ports results in command injection. This vulnerability is reported as CVE-2026-82413. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in ntop ntopng up to 6.7.260716. This affects the function ntop.execCmd of the file scripts/lua/rest/v2/add/host/to_scan.lua of the component Vulnerability-Scan Scheduler. The manipulation of the argument scan_ports with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated session, including non-administrator users, while deployments with login disabled expose the same request without authentication. The endpoints validate scan_ports with validateSingleWord, which permits shell metacharacters, and persist the value for the minute vulnerability-scan scheduler. The scheduler concatenates the value into an nmap command through nmap_scan_host and executes it through ntop.execCmd or ntop.execCmdAsync using popen. For the tcp_portscan and cve modules, a preliminary nmap -sn probe must first report the target as up before the attacker-controlled ports are used. When nmap is installed, this command injection allows arbitrary operating-system commands to execute as the ntopng service account without further user interaction. This issue is fixed in version 6.7.260717.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-82413 since 08/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 6.7.260717 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• ntop

Name

• ntopng

Version

• 6.7.260716

Website

• Product: https://github.com/ntop/ntopng/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion