{"id":"CVE-2026-82413","title":"ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)","summary":"ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated sessio…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-77","CWE-78","CWE-88"],"vendor":"ntop","product":"ntopng","affected":["ntopng < 6.7.260717"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T16:04:14.697Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82413","references":[{"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-9xj6-f266-r46p","label":"https://github.com/ntop/ntopng/security/advisories/GHSA-9xj6-f266-r46p"},{"url":"https://github.com/ntop/ntopng/commit/fda269014c6a8a445c2c893cf9d2fad0128364a5","label":"https://github.com/ntop/ntopng/commit/fda269014c6a8a445c2c893cf9d2fad0128364a5"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T22:38:31.324Z","epss":0.01072,"epssPercentile":0.65049,"slug":"CVE-2026-82413","body":"## Overview\n\nntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated session, including non-administrator users, while deployments with login disabled expose the same request without authentication. The endpoints validate scan_ports with validateSingleWord, which permits shell metacharacters, and persist the value for the minute vulnerability-scan scheduler. The scheduler concatenates the value into an nmap command through nmap_scan_host and executes it through ntop.execCmd or ntop.execCmdAsync using popen. For the tcp_portscan and cve modules, a preliminary nmap -sn probe must first report the target as up before the attacker-controlled ports are used. When nmap is installed, this command injection allows arbitrary operating-system commands to execute as the ntopng service account without further user interaction. This issue is fixed in version 6.7.260717.\n\n## Affected\n\n- `ntopng < 6.7.260717`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}