The vulnerability arises because the Cacti application fails to regenerate the session ID after a successful login, allowing an attacker to predefine or fix a session identifier and subsequently hijack a session. This flaw results in session fixation, where a compromised session cookie enables an attacker to impersonate a legitimate user and gain unauthorized access to monitoring and fault‑management data. The weakness is classified as CWE‑384, indicating that the session is not refreshed to prevent fixation.

Cacti, the open‑source performance and fault‑management framework, is affected in all releases up to and including version 1.2.30. Version 1.2.31 introduces the fix by calling session_regenerate_id() after authentication. No other vendors or products are listed as affected.

The CVSS score of 5.4 indicates moderate risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is same‑site, where an attacker must provide a valid session identifier to the target browser—either by tricking the user into visiting a URL that includes a prefixed session ID or by exploiting pre‑existing session cookies. Successful exploitation would allow session hijacking and unauthorized access with the same privileges as the compromised user.