Potential CVE-2022-46169 Command Injection Probe Against Cacti Web Server
Alert on GET requests to Cacti polldata endpoints containing command-injection payload fragments tied to CVE-2022-46169.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-27
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags HTTP GET requests to /remote_agent.php with action=polldata and a poller_id parameter that also contain indicators of command execution payloads, including base64-decoding and shell invocation patterns. Such behavior matters because it aligns with attempts to exploit Cacti command injection to run arbitrary commands on the server. It relies on web server request telemetry capturing method and query-string contents, including URL-encoded variants of the suspicious payload fragments.
Reporting behind it
- github.comhttps://github.com/0xf4n9x/CVE-2022-46169
- github.comhttps://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf
- github.comhttps://github.com/rapid7/metasploit-framework/pull/17407
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-46169/web_cve_2022_46169_cacti_exploitation_attempt.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Potential CVE-2022-46169 Command Injection Probe Against Cacti Web Server
id: d0ca4cf5-c0c8-4c54-bf3e-0162a45dcf5f
status: test
description: This rule flags HTTP GET requests to /remote_agent.php with action=polldata and a poller_id parameter that also contain indicators of command execution payloads, including base64-decoding and shell invocation patterns. Such behavior matters because it aligns with attempts to exploit Cacti command injection to run arbitrary commands on the server. It relies on web server request telemetry capturing method and query-string contents, including URL-encoded variants of the suspicious payload fragments.
references:
- https://github.com/0xf4n9x/CVE-2022-46169
- https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf
- https://github.com/rapid7/metasploit-framework/pull/17407
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-46169/web_cve_2022_46169_cacti_exploitation_attempt.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-27
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2022-46169
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-method: GET
cs-uri-query|contains|all:
- /remote_agent.php
- action=polldata
- poller_id=
cs-uri-query|contains:
- "| base64 -d | /bin/bash`"
- "%7C%20base64%20-d%20%7C%20%2Fbin%2Fbash%60"
- "`whoami"
- powershell
- cmd
- wget
condition: selection
falsepositives:
- Web vulnerability scanners
level: high
license: DRL-1.1
related:
- id: 738cb115-881f-4df3-82cc-56ab02fc5192
type: derived