$ cve CVE-2019-15949 JSON

CVE-2019-15949 KEV EXPLOIT

8.8

HIGH · CVSS 3.1 · EPSS 77% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.

Scoring

CVSS	8.8 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	77.04% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-78
On CISA KEV	yes — remediate by 2022-05-03
Public exploit	yes
Published	2019-09-05
Last modified	2026-06-17

CISA KEV

Name	Nagios XI Remote Code Execution Vulnerability
Added	2021-11-03
Due	2022-05-03
Vendor / product	Nagios / Nagios XI
Ransomware use	none reported

Affected (1)

Vendor	Product
nagios	nagios xi

Public exploits

Source	Title	Date
exploit-db	Nagios Xi 5.6.6 - Authenticated Remote Code Execution (RCE)	2025-04-08
exploit-db	Nagios XI - Authenticated Remote Command Execution (Metasploit)	2020-03-10

References

→ the Explorer · watch your stack · NVD