Findings from a code review of the WMI exec path (`linux_wmi.php`). These are environmental/compatibility gaps, not fixed by the current security PRs (#13, #14).
Cacti server on Windows is unsupported
`Linux_WMI::__construct()` hardcodes `/usr/bin//wmic` (and `wmi_tools.php`/`script/wmi-script.php` set `plugins/wmi/wmic`), and `exec()` shells out to the Linux `wmic` client. There is no win32 branch. The `$config[cacti_server_os] = 'unix'` line in `exec()` is a dead local assignment. On a Windows Cacti server the plugin cannot run. Either detect the server OS and use a Windows WMI path (PowerShell/CIM), or document Linux-server-only.
Note: this is about the server binary. It is unrelated to Microsoft deprecating the Windows `wmic.exe` tool (Feature-on-Demand in Win11 24H2 / Server 2025); the plugin does not use Windows `wmic.exe`.
Modern Windows hosts reject the legacy client
The bundled Linux `wmic` (openwsman/Samba4 era) speaks DCOM/MSRPC with NTLMSSP and defaults to NTLMv1. Against current Windows targets this commonly fails:
- NTLMv1 disabled / NTLM deprecation (Windows Server 2016+ hardening) → auth failure. The commented `--option="client_ntlmv2_auth"=Yes` in `exec()` is evidence this was hit; there is no way to set it from the UI.
- DCOM hardening (KB5004442, enforced 2022+) raised the default authentication level to Packet Integrity → `RPC_E_ACCESS_DENIED` / 0x80070005 with the old client.
Suggest exposing an NTLMv2/auth-level option per account or query, and documenting the required Windows-side DCOM/WMI configuration.
Minor: clean() is not idempotent
`clean()` reassigns `$this->username/password/binary/command` in place with `cacti_escapeshellarg`. A second `getcommand()`/`exec()` on the same object double-escapes them. Current callers build a fresh object per query, so this is latent, but building the command from locals would remove the footgun.
Findings from a code review of the WMI exec path (`linux_wmi.php`). These are environmental/compatibility gaps, not fixed by the current security PRs (#13, #14).
Cacti server on Windows is unsupported
`Linux_WMI::__construct()` hardcodes `/usr/bin//wmic` (and `wmi_tools.php`/`script/wmi-script.php` set `plugins/wmi/wmic`), and `exec()` shells out to the Linux `wmic` client. There is no win32 branch. The `$config[cacti_server_os] = 'unix'` line in `exec()` is a dead local assignment. On a Windows Cacti server the plugin cannot run. Either detect the server OS and use a Windows WMI path (PowerShell/CIM), or document Linux-server-only.
Note: this is about the server binary. It is unrelated to Microsoft deprecating the Windows `wmic.exe` tool (Feature-on-Demand in Win11 24H2 / Server 2025); the plugin does not use Windows `wmic.exe`.
Modern Windows hosts reject the legacy client
The bundled Linux `wmic` (openwsman/Samba4 era) speaks DCOM/MSRPC with NTLMSSP and defaults to NTLMv1. Against current Windows targets this commonly fails:
Suggest exposing an NTLMv2/auth-level option per account or query, and documenting the required Windows-side DCOM/WMI configuration.
Minor: clean() is not idempotent
`clean()` reassigns `$this->username/password/binary/command` in place with `cacti_escapeshellarg`. A second `getcommand()`/`exec()` on the same object double-escapes them. Current callers build a fresh object per query, so this is latent, but building the command from locals would remove the footgun.