PT-2025-44462 · Nagios Enterprises · Nagios Xi

Published 2025-10-30 · Updated 2025-10-30 · CVE-2020-36856

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.6.14

Description Nagios XI versions prior to 5.6.14 have an authenticated remote command execution issue in the command test.php script within the Core Config Manager (CCM). A lack of proper validation of the address parameter allows an authenticated user with access to the CCM to inject shell metacharacters. Successful exploitation can lead to arbitrary command execution with the privileges of the Nagios XI web application user, potentially allowing for commands to be run on the underlying host, system configuration changes, or full system compromise.

Recommendations Update Nagios XI to version 5.6.14 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14519

CVE-2020-36856

Affected Products

Nagios Xi

References · 7

• https://nagios.com/changelog/nagios-xi · Patch
• https://osv.dev/vulnerability/CVE-2020-36856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36856 · Security Note
• https://bdu.fstec.ru/vul/2025-14519 · Security Note
• https://vulncheck.com/advisories/nagios-xi-authenticated-rce-command-test-php-via-address · Note
• https://nagios.com/products/security/#nagios-xi · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1984015896050802727 · Twitter Post