Vulnerability · Published Oct 30, 2025 · Assigned by VulnCheck

CVE-2020-36868Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script

High 8.5

In plain English

A high-severity security flaw in XI from Nagios. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.3%top 72.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some deployments executed with elevated privileges. A local attacker with low-level access could exploit these weaknesses to cause the script to execute arbitrary commands or modify privileged files, resulting in privilege escalation.

Affected products (as reported)

Vendor	Product	Versions
Nagios	XI	0 – before 5.7.3

Weakness: CWE-73, CWE-250 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.nagios.com/changelog/nagios-xi/ release-notes, patch
https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-insecure-getprofile-script third-party-advisory