CVE-2013-10073CWE-78command-injection

CVE-2013-10073

High · published October 31, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
88.7
In the wild
Unconfirmed
What it is

⚡ A sneaky shell command injection in Nagios XI could let an authenticated user run arbitrary commands — like giving a kid the keys to the cookie jar! 🍪 This vulnerability is like a waiter taking a kitchen order without checking for allergies. If someone orders a peanut butter dish without proper checks, it can lead to some serious reactions! An attacker could exploit this vulnerability to execute any command on the server with the same privileges as the application service. This could lead to unauthorized access to sensitive information, changes to system configurations, or even a complete system takeover — absolutely devastating!

Put simply

This vulnerability is like a waiter taking a kitchen order without checking for allergies. If someone orders a peanut butter dish without proper checks, it can lead to some serious reactions! In Nagios XI versions prior to 2012R1.6, user input for the Auto-Discovery tool is passed directly to the shell without proper sanitation or quoting, allowing for command injection by authenticated users with access to discovery features.

What to do

An attacker could exploit this vulnerability to execute any command on the server with the same privileges as the application service. This could lead to unauthorized access to sensitive information, changes to system configurations, or even a complete system takeover — absolutely devastating! Upgrade Nagios XI to version 2012R1.6 or later to patch this vulnerability. Additionally, review your user access controls and ensure that only trusted users have access to discovery functionalities. Regularly audit any user input to the system for improvements. You've got this! With these steps, you can protect your systems and keep the cookie jar safe! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03377 · 88.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-10-31T02:15Z
Affected products (7)
ProductVersionsFixed in
nagios/nagios_xi< 20122012
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
nagios/nagios_xiall versions—
References (2)
EPSS history
Timeline
  • 30 OCT 21:32Z
    Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection
    cvelistv5