CVE-2026-82413— ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)

Quick assessment

Affected

ntop ntopng

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ntopng 是一款基于 Web 的网络流量监控应用。在版本 6.7.260717 之前，脚本和会接受来自任何已认证会话（包括非管理员用户）的参数；而在禁用登录功能的部署环境中，相同请求甚至无需认证即可提交。这些端点使用函数对进行校验，该函数允许包含 Shell 元字符，并将该值保存供“漏洞扫描调度器”使用。调度器随后通过函数将该值拼接到 nmap 命令中，并经由或使用执行。对于和模块，需先通过初步的探测确认目标主机处于在线状态，之后才会使用由攻击者控制的端口参数。当系统中已安装 nmap

CVSS 8.8 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1210 · Exploitation of Remote Services T1059.004 · Unix Shell T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)

Source: CVE Program / CVE List V5

Vulnerability Description

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated session, including non-administrator users, while deployments with login disabled expose the same request without authentication. The endpoints validate scan_ports with validateSingleWord, which permits shell metacharacters, and persist the value for the minute vulnerability-scan scheduler. The scheduler concatenates the value into an nmap command through nmap_scan_host and executes it through ntop.execCmd or ntop.execCmdAsync using popen. For the tcp_portscan and cve modules, a preliminary nmap -sn probe must first report the target as up before the attacker-controlled ports are used. When nmap is installed, this command injection allows arbitrary operating-system commands to execute as the ntopng service account without further user interaction. This issue is fixed in version 6.7.260717.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

在命令中使用的特殊元素转义处理不恰当(命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ntop	ntopng	< 6.7.260717	-

II. Public POCs for CVE-2026-82413

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-82413

请登录查看更多情报信息。

Other References for CVE-2026-82413 (2)

https://github.com/ntop/ntopng/security/advisories/GHSA-9xj6-f266-r46p x_refsource_CONFIRM
https://github.com/ntop/ntopng/commit/fda269014c6a8a445c2c893cf9d2fad0128364a5 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-82413

IV. Related Vulnerabilities

Same product: ntopng

Same vendor: ntop

Same weakness: CWE-77