CVE-2019-15949
Nagios XI Remote Code Execution Vulnerability
- Published
- Sep 5, 2019
- Updated
- Oct 21, 2025
- Assigning CNA
- mitre
- Evidence observed
- Mar 10, 2020
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.5%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.
Sources
- Nagios XI ScannerModule
modules/auxiliary/scanner/http/nagios_xi_scanner.rb
Metasploit Framework modulesDeclared conditions
- verification: check_not_declared($.auxiliary_scanner/http/nagios_xi_scanner.check)
modules/exploits/linux/http/nagios_xi_plugins_check_plugin_authenticated_rce.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_linux/http/nagios_xi_plugins_check_plugin_authenticated_rce.platform)
- verification: check_declared($.exploit_linux/http/nagios_xi_plugins_check_plugin_authenticated_rce.check)
- nagiosxi-root-rce-exploitExploit
POC which exploits a vulnerability within Nagios XI (5.6.5) to spawn a root shell
- Nagios-CVE-2019-15949-RCEExploit
a PoC for the Nagios CVE-2019-15949 rce in python
Metasploit · linux · Mar 10, 2020
Calil Khalil · multiple · Apr 8, 2025
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.