PT-2025-1386 · Opsview · Opsview Monitor Agent

Wthj · Published 2025-01-09 · Updated 2025-01-10 · CVE-2023-28354

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Opsview Monitor Agent version 6.8

Description A problem was discovered in Opsview Monitor Agent where an unauthenticated remote attacker can call check nrpe against affected targets, specifying known NRPE plugins. In default installations, these plugins are configured to accept command control characters and pass them to command-line interpreters for NRPE plugin execution. This allows the attacker to escape NRPE plugin execution and execute commands remotely on the target as NT AUTHORITYSYSTEM.

Recommendations For Opsview Monitor Agent version 6.8, consider disabling the check nrpe function until a patch is available to prevent remote attackers from executing commands on the target system. Restrict access to known NRPE plugins to minimize the risk of exploitation. Avoid using command control characters in NRPE plugin configurations to prevent attackers from escaping plugin execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-28354

Affected Products

Opsview Monitor Agent

References · 4

• 🔥 https://github.com/stormfleet/CVE-2023-28354/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28354 · Security Note
• https://twitter.com/CVEnew/status/1877620704549781651 · Twitter Post
• https://t.me/cvedetector/14944 · Telegram Post