CVE-2017-16834

High

Published: 16/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account. Exploiting these files can lead to root code execution by local users.

Risk Assessment

Local users can gain elevated privileges, posing a serious security threat to the organization's system and data.

Recommendation

It is recommended to change the ownership of the npcd and npcd.cfg files to an account with appropriate privileges and review the system's security configuration.

Other vulnerabilities in PNP4Nagios

See all

CVE-2023-38350Medium
PNP4Nagios version 0.6.26 has a stored XSS vulnerability in the AJAX controller via the basket API and filters.
CVE-2023-38349High
PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects version 0.6.26.

Original NVD description (English source)

PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account.