CVE-2014-5261

CVE-2014-5261 describes a critical command injection vulnerability in Cacti 0.8.8b and earlier, specifically within the graph settings script (graph_settings.php). This flaw allows unauthenticated remote attackers to execute arbitrary commands on the server by injecting shell metacharacters into font size parameters, which are then passed to the rrdtool commandline. With a CVSS score of 7.5, this vulnerability presents a high risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While no public exploit code (Metasploit, Nuclei, ExploitDB) or active exploitation has been observed, and community discussion and media coverage are minimal, the ease of exploitation makes it a significant concern.