Actively exploited in the wild
Nagios XI Remote Code Execution Vulnerability
Nagios - Nagios XI · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-15949
HighCVSS 8.8KEVSummary
Nagios XI before 5.6.6 allows remote command execution as root. Exploitation requires access to the server as the nagios user or as the admin user via the web interface; the getprofile.sh script is executed as root via a passwordless sudo entry and runs check_plugin, which is owned by the nagios user.
Risk Assessment
A user with permissions to modify plugins or the nagios user can modify the check_plugin executable and insert malicious commands, gaining full control over the system as root.
Recommendation
Update Nagios XI to version 5.6.6 or later and restrict permissions to modify plugins and access the nagios account.
Other vulnerabilities in Nagios XI
See all- CVE-2023-40931Medium
A SQL injection vulnerability in Nagios XI versions 5.11.0 through 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in a POST request to /nagiosxi/admin/banner_message-ajaxhelper.php.
- CVE-2021-25299Medium
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS) in /usr/local/nagiosxi/html/admin/sshterm.php due to improper input sanitization. A crafted URL can steal admin session cookies or be chained with other bugs for one-click RCE.
- CVE-2021-25298HighActively exploited
Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.
- CVE-2021-25297HighActively exploited
A vulnerability in Nagios XI version xi-5.7.5 allows OS command injection. The issue exists in the switch.inc.php file due to improper sanitization of authenticated user input.
- CVE-2021-25296HighActively exploited
Nagios XI version xi-5.7.5 is affected by OS command injection in the file windowswmi.inc.php due to improper sanitization of authenticated user input. This allows execution of arbitrary commands on the server.
- CVE-2023-24035Low
An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses an insecure timing comparison that leads to an attacker being able to bruteforce the admin password by measuring timing differences in the comparison.
- CVE-2023-24034Low
An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using an open redirect vulnerability.
- CVE-2023-7314Medium
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- CVE-2023-7313Medium
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- CVE-2025-56432Medium
A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.
Original NVD description (English source)
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.