CVE-2026-82412
Received Received - Intake

Command Injection in ntopng Network Monitoring Tool

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng's CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user's browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-82412
EUVD
EUVD-2026-83982

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ntop ntopng to 6.7.260717 (exc)
ntop ntopng 6.7.260717

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82412 is a Remote Code Execution (RCE) flaw in ntopng, a network monitoring tool. It allows authenticated non-admin users to execute arbitrary OS commands as the ntopng process account by exploiting improper input validation in vulnerability scan endpoints. The scan_ports parameter is passed directly to shell commands without proper sanitization, enabling command injection via shell metacharacters.

Detection Guidance

Check if your ntopng version is below 6.7.260717. Run 'ntopng --version' to verify. Inspect network traffic for unusual nmap scan commands or unexpected outbound connections from the ntopng process. Review logs for unauthorized command execution attempts in system or application logs.

Impact Analysis

An attacker could gain full control over the system running ntopng, potentially stealing data, installing malware, or disrupting network operations. Since ntopng often runs with root privileges, the impact includes complete system compromise. Exploitation can occur via CSRF attacks without needing credentials.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements and HIPAA's safeguards for protected health information. Organizations may face fines, legal penalties, and reputational damage due to non-compliance.

Mitigation Strategies

Upgrade ntopng to version 6.7.260717 or later immediately. Disable or restrict access to the vulnerable REST API endpoints if upgrading is not immediately possible. Ensure ntopng does not run as root to limit potential damage from exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82412. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart