CVE-2026-82413

Summary

The ntopng application before version 6.7.260717 allows authenticated (or unauthenticated if login is disabled) non-administrative users to inject shell metacharacters into the scan_ports parameter, which is later concatenated into an nmap command and executed via popen, leading to arbitrary OS command execution as the ntopng service account.

Exploitability

Exploitation requires either a non-admin authenticated session or access to a deployment with login disabled; the validateSingleWord check permits shell metacharacters, making injection straightforward once the vulnerable endpoints are reachable.

Blast radius

Successful exploitation grants full OS-level command execution as the ntopng service account, potentially compromising all data accessible to that account and enabling lateral movement within the network.

Detection

Look for suspicious entries in ntopng logs showing scheduled vulnerability scans with unexpected shell metacharacters (e.g., semicolons, pipes, backticks) in the scan_ports field, or observe system-level process execution of nmap commands containing non-standard port syntax or appended shell commands. If no such logging occurs, no reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ntopng version 6.7.260717 or later, which fixes the command injection vulnerability by properly sanitizing the scan_ports parameter.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.