The vulnerability permits an attacker to craft a URL that forces the ntopng application to redirect users to an arbitrary, untrusted site. This open redirect can be used for phishing, social engineering, or to lure users into malicious domains, compromising the integrity of the user experience but not directly granting code execution or data exfiltration. The weakness is identified as CWE‑601.

It affects the ntopng product from the ntop vendor. Specific affected versions are not listed, but the announced remedy is to upgrade to the latest available release.

With a CVSS score of 4.3 the vulnerability is considered low severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The likely attack vector involves a remote user clicking a manipulated link or visiting a URL that triggers ntopng’s redirect logic. While an attacker cannot directly hijack a session or execute code, the ability to redirect users to malicious sites increases the risk of phishing and user confusion. Acting on the vendor’s recommendation to update mitigates the risk entirely.