{"id":"CVE-2026-82413","kind":"vulnerability","aliases":["CVE-2026-82413"],"related":[],"title":"ntopng: scan port parameter lets authenticated users run OS commands","description":"ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated session, including non-administrator users, while deployments with login disabled expose the same request without authentication. The endpoints validate scan_ports with validateSingleWord, which permits shell metacharacters, and persist the value for the minute vulnerability-scan scheduler. The scheduler concatenates the value into an nmap command through nmap_scan_host and executes it through ntop.execCmd or ntop.execCmdAsync using popen. For the tcp_portscan and cve modules, a preliminary nmap -sn probe must first report the target as up before the attacker-controlled ports are used. When nmap is installed, this command injection allows arbitrary operating-system commands to execute as the ntopng service account without further user interaction. This issue is fixed in version 6.7.260717.","summary":"ntopng's REST endpoints for scheduling vulnerability scans pass the scan_ports value unsanitized into an nmap shell command. An attacker who can make an API request, even as a non-admin user or without login when login is disabled, can run arbitrary operating-system commands as the ntopng service account.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","nmap","ntopng","package","self-hosted"],"not_affected_if":["nmap-not-installed","patched-version"],"how_to_check":"- Check the installed ntopng version and compare it with the fixed version below.\n- Confirm whether nmap is installed on the host, since the injection needs nmap present.\n- Check whether login is disabled in the ntopng configuration, which exposes the endpoints without authentication.","fix":"- ntopng: upgrade to `6.7.260717` or later.","status":"open","published_at":"2026-11-05T17:18:21+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","triaged_at":"2026-11-05T17:42:04+00:00","updated_at":"2026-11-05T17:42:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T17:42:04Z","model":"claude-haiku-5-5","output":{"fix":"- ntopng: upgrade to `6.7.260717` or later.","reach":"network","title":"ntopng: scan port parameter lets authenticated users run OS commands","impact":"high","summary":"ntopng's REST endpoints for scheduling vulnerability scans pass the scan_ports value unsanitized into an nmap shell command. An attacker who can make an API request, even as a non-admin user or without login when login is disabled, can run arbitrary operating-system commands as the ntopng service account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ntopng","self-hosted","nmap","linux"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Arbitrary OS commands run as the ntopng service account","analyst_note":"","how_to_check":"- Check the installed ntopng version and compare it with the fixed version below.\n- Confirm whether nmap is installed on the host, since the injection needs nmap present.\n- Check whether login is disabled in the ntopng configuration, which exposes the endpoints without authentication.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","nmap-not-installed"],"who_is_affected":"ntopng instances prior to 6.7.260717 are exposed, particularly where nmap is installed. Exposure is worse where login is disabled, because the REST endpoints then accept the request without any credentials. Systems that do not run ntopng, or that run it with a patched version, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4482,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82413':13A,16A '6.7.260717':89C,217C 'accept':93C 'account':76B,206C 'admin':56B 'administr':103C 'allow':194C 'api':49B 'applic':86C 'arbitrari':67B,195C 'attack':44B,182C 'attacker-control':181C 'authent':6A,98C,115C 'base':82C 'command':10A,42B,71B,146C,192C,199C 'concaten':140C 'control':183C 'cve':11A,14A,165C 'deploy':106C 'disabl':64B,109C 'endpoint':27B,117C 'even':51B 'execut':152C,201C 'expos':110C 'first':173C 'fix':214C 'host':23B,150C 'includ':100C 'inject':193C 'instal':190C 'interact':210C 'issu':212C 'let':5A 'linux':17B 'login':60B,62B,108C 'make':47B 'metacharact':126C 'minut':133C 'modul':166C 'monitor':85C 'must':172C 'network':83C 'nmap':18B,40B,145C,148C,169C,188C 'non':55B,102C 'non-admin':54B 'non-administr':101C 'ntop.execcmd':155C 'ntop.execcmdasync':157C 'ntopng':1A,19B,24B,74B,77C,204C 'oper':69B,197C 'operating-system':68B,196C 'os':9A 'packag':20B 'paramet':4A 'pass':32B 'permit':124C 'persist':128C 'popen':159C 'port':3A,35B,95C,120C,184C 'portscan':163C 'preliminari':168C 'prior':87C 'probe':171C 'report':174C 'request':50B,113C 'rest':26B 'run':8A,66B 'scan':2A,31B,34B,94C,119C,136C,149C 'schedul':29B,137C,139C 'scripts/lua/rest/v2/add/host/to_scan.lua':90C 'scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua':92C 'self':22B 'self-host':21B 'servic':75B,205C 'session':99C 'shell':41B,125C 'sn':170C 'system':70B,198C 'target':176C 'tcp':162C 'traffic':84C 'unsanit':37B 'use':158C,186C 'user':7A,57B,104C,209C 'valid':118C 'validatesingleword':122C 'valu':36B,130C,142C 'version':216C 'vulner':30B,135C 'vulnerability-scan':134C 'web':81C 'web-bas':80C 'without':59B,114C,207C","nicknames":[],"mitigations":[],"who_affected":"ntopng instances prior to 6.7.260717 are exposed, particularly where nmap is installed. Exposure is worse where login is disabled, because the REST endpoints then accept the request without any credentials. Systems that do not run ntopng, or that run it with a patched version, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","linux","nmap","ntopng","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-16T09:15:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82413","severity":null,"published_at":"2026-11-05T17:18:21+00:00","modified_at":"2026-11-05T17:18:21+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","fetched_at":"2026-11-05T17:40:05+00:00","note":null}],"documents":[{"id":78137,"url":"https://github.com/ntop/ntopng/commit/fda269014c6a8a445c2c893cf9d2fad0128364a5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78138,"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-9xj6-f266-r46p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-16T09:15:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}