Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-84990— ntopng: Missing Authorization on System Configuration Backup Download and Listing

Quick assessment

Affected
ntop ntopng
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ntopng 是一款基于 Web 的网络流量监控应用程序。在版本 6.7.260718 之前，文件 和 允许任何经过身份验证的非管理员用户在未进行管理员权限检查的情况下列出并下载系统配置备份。下载路径会调用 函数，而 会将 的 Redis 键空间包含在备份中。因此，下载的备份可能泄露本地用户的密码哈希值，并且在配置了相应功能的情况下，还可能泄露 API 令牌、TOTP（基于时间的一次性密码）密钥以及 WebAuthn 凭据数据，从而攻击者可以利用这些可用或可恢复的凭据实施账户入侵。该问题已在版本 6.7.26071

CVSS 8.8 · High EPSS 0.33% · P25

Affected Version Matrix 1

VendorProduct Version RangeStatus
ntop ntopng < 6.7.260718 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84990

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ntopng: Missing Authorization on System Configuration Backup Download and Listing
Source: CVE Program / CVE List V5
Vulnerability Description
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ntop ntopng < 6.7.260718 -

II. Public POCs for CVE-2026-84990

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84990

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-84990 (1)

Other References for CVE-2026-84990 (1)

Same Patch Batch · ntop · 2026-09-21 · 3 CVEs total

CVE-2026-82412 8.8 HIGH ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API
CVE-2026-83621 8.1 HIGH ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat In

IV. Related Vulnerabilities

Same product: ntopng
Same vendor: ntop
Same weakness: CWE-200

V. Comments for CVE-2026-84990

No comments yet

Leave a comment