CVE-2020-36856

Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script. Insufficient validation of the `address` parameter allows an authenticated user with access to the Core Config Manager to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and may be leveraged to execute commands on the underlying XI host, modify system configuration, or fully compromise the host.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.nagios.com/changelog/nagios-xi/	Release Notes
https://www.nagios.com/products/security/#nagios-xi	Release Notes
https://www.vulncheck.com/advisories/nagios-xi-authenticated-rce-command-test-php-via-address	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*

History

18 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Nagios XI anteriores a la 5.6.14 contienen una vulnerabilidad de ejecución remota de comandos autenticada en el script CCM command_test.PHP. La validación insuficiente del parámetro 'address' permite a un usuario autenticado con acceso al Core Config Manager inyectar metacaracteres de shell que se incorporan en las invocaciones de comandos de backend. La explotación exitosa permite la ejecución arbitraria de comandos con los privilegios del usuario de la aplicación web de Nagios XI y puede aprovecharse para ejecutar comandos en el host XI subyacente, modificar la configuración del sistema o comprometer completamente el host.

Information

Published : 2025-10-30 22:15

Updated : 2026-10-18 00:10

NVD link : CVE-2020-36856

Mitre link : CVE-2020-36856

CVE.ORG link : CVE-2020-36856

JSON object : View

Products Affected

nagios

nagios_xi

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2020-36856", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2020-36856", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-31T15:03:19.106296Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Nagios", "modules": ["CCM (Configuration Component Module)"], "product": "XI", "versions": [{"status": "affected", "version": "0", "lessThan": "5.6.14", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-30T22:15:38.123", "references": [{"url": "https://www.nagios.com/changelog/nagios-xi/", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.nagios.com/products/security/#nagios-xi", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nagios-xi-authenticated-rce-command-test-php-via-address", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script. Insufficient validation of the `address` parameter allows an authenticated user with access to the Core Config Manager to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and may be leveraged to execute commands on the underlying XI host, modify system configuration, or fully compromise the host."}, {"lang": "es", "value": "Las versiones de Nagios XI anteriores a la 5.6.14 contienen una vulnerabilidad de ejecuci\u00f3n remota de comandos autenticada en el script CCM command_test.PHP. La validaci\u00f3n insuficiente del par\u00e1metro 'address' permite a un usuario autenticado con acceso al Core Config Manager inyectar metacaracteres de shell que se incorporan en las invocaciones de comandos de backend. La explotaci\u00f3n exitosa permite la ejecuci\u00f3n arbitraria de comandos con los privilegios del usuario de la aplicaci\u00f3n web de Nagios XI y puede aprovecharse para ejecutar comandos en el host XI subyacente, modificar la configuraci\u00f3n del sistema o comprometer completamente el host."}], "lastModified": "2026-10-18T00:10:00.123", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06D06A15-DDB3-4113-89DE-69A35463489D", "versionEndExcluding": "5.6.14"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}