Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck

CVE-2020-36856Nagios XI < 5.6.14 Authenticated RCE command_test.php via address

Critical 9.4

In plain English

A critical-severity OS command injection in XI from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 84% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)2.5%top 15.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script. Insufficient validation of the `address` parameter allows an authenticated user with access to the Core Config Manager to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and may be leveraged to execute commands on the underlying XI host, modify system configuration, or fully compromise the host.

Affected products (as reported)

Vendor	Product	Versions
Nagios	XI	0 – before 5.6.14

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.nagios.com/products/security/#nagios-xi vendor-advisory, patch
https://www.nagios.com/changelog/nagios-xi/ release-notes, patch
https://www.vulncheck.com/advisories/nagios-xi-authenticated-rce-command-test-php-via-address third-party-advisory