CVE-2022-46169

CVE-2022-46169 is a critical pre-authentication command injection vulnerability discovered in the Cacti network operations framework. This flaw, which existed in all versions of Cacti up to 1.2.22, could be exploited by threat actors to deliver malware, thereby compromising the security of systems using this software. The Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its catalog of known exploited vulnerabilities in February 2023, highlighting its significance and potential impact on cybersecurity. In April 2023, FortiGuard Labs researchers observed an active hacking campaign that was exploiting this vulnerability, along with another flaw in Realtek (CVE-2021-35394). The attackers were using these vulnerabilities to spread two types of malware: ShellBot and Moobot. ShellBot is known for targeting Linux SSH servers, while Moobot has been seen targeting D-Link devices. These malwares can cause significant damage and disruption by taking over the affected systems and integrating them into botnets. The exploitation of CVE-2022-46169 underscores the importance of timely patching and system updates. Organizations utilizing Cacti are urged to update their systems to the latest version to mitigate the risk associated with this vulnerability. Further, it is recommended to follow best cybersecurity practices such as regularly monitoring system logs, employing strong and unique passwords, and implementing multi-factor authentication where possible to enhance overall system security.