ntopng’s vulnerability‑scan REST API accepts a scan_ports parameter that is not validated beyond a single‑word check, allowing shell metacharacters to be injected. The parameter is then concatenated into an nmap command and executed by the ntopng process using ntop.execCmd or similar functions, enabling any authenticated user without administrative privileges to run arbitrary operating‑system commands. Additionally, the use of GET requests bypasses CSRF protection, meaning a logged‑in user’s browser can trigger the injection without possessing ntopng credentials. This flaw directly leads to remote code execution on the host running ntopng, fully compromising confidentiality, integrity, and availability of that system.

The vulnerability affects ntop’s ntopng product, specifically all releases prior to version 6.7.260717. Users of ntopng installations running any earlier version must ensure they are aware of this issue.

The CVSS score of 8.8 indicates a high‑severity flaw. While EPSS is not available, the lack of a KEV listing does not diminish the risk for exposed systems. The flaw can be exercised through the exposed REST API endpoints and via CSRF from a browser, requiring only authentication as a non‑administrator. Because the attacker can execute commands as the ntopng process account, successful exploitation allows full control over the host.