CVE-2026-40941

Katalog CVE

CVSS 6.5 · Medium EPSS 0,27%

Kerentanan Improper Verification of Cryptographic Signature pada cacti. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

29 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Cacti/cacti/security/advisories/GHSA-274c-97hj-pv2v advisory vendor
• https://github.com/Cacti/cacti/pull/7054 issue tracking · patch
• https://github.com/Cacti/cacti/releases/tag/release%2F1.2.31 product · release notes