Command Injection Vulnerability in ntopng Network Traffic Monitoring Application

CVE-2026-82413

What is CVE-2026-82413?

The ntopng web-based network traffic monitoring application is vulnerable to command injection through specific endpoints that allow non-administrator users to manipulate scan ports without adequate validation. This flaw resides in the handling of user-provided input in the scripts, which permits shell metacharacters and allows attackers to execute arbitrary commands as the ntopng service account. The vulnerability is exacerbated in installations where authentication measures are disabled, making them more susceptible to exploitation. This issue has been resolved in ntopng version 6.7.260717.

References