CVE-2018-8736

EPSS 46.9%

Vexday Risk Score

50Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 46.9%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

06 Mar 2016Metasploit module available

18 Apr 2018Published on NVD

30 Apr 2018Public PoC

Weaponization speed

12 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.

Affected products

n/a · n/a

public PoCs found — 4

cve_referencewww.exploit-db.com/exploits/44560/unverified cve_referencewww.exploit-db.com/exploits/44969/unverified exploitdbwww.exploit-db.com/exploits/44969unverified exploitdbwww.exploit-db.com/exploits/44560unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT https://blog.redactedsec.net/exploits/2018/04/26/nagios.html https://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0f https://www.exploit-db.com/exploits/44560/https://www.exploit-db.com/exploits/44969/https://www.nagios.com/downloads/nagios-xi/change-log/