CVE-2020-7058: Cacti

High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days.

data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host. NOTE: the vendor has stated "This is a false alarm.

Affected products

• Cacti Cacti: version 1.2.8 only

Published 2020-01-15. Last modified 2026-06-17.