CVE-2019-15949
Published: November 3, 2021
Official Description
Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.
CISA KEV Advisory
Nagios XI Remote Code Execution Vulnerability
Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.
Apply updates per vendor instructions.
Risk Analysis
Nagios XI contains a remote code execution vulnerability where an attacker can modify the check_plugin executable to insert and execute malicious commands as root. This high-severity flaw, with an EPSS score of 0.88593 and confirmed exploitation in the wild, allows for complete system compromise.
This vulnerability has been actively exploited in the wild and is listed in CISA's KEV catalog. The ability to modify an executable and run commands as root indicates a severe remote code execution capability.
Apply the latest security updates and patches for Nagios XI. Implement strict file permissions on critical executables and monitor for unauthorized changes to system files.
Technical Analysis
CVE-2019-15949 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2019-15949 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2019-15949 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1