CVE-2020-5792

EPSS 61.0%

Vexday Risk Score

30Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 61.0%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

20 Oct 2020Metasploit module available

20 Oct 2020Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.

Affected products

n/a · Nagios XI

References

http://packetstormsecurity.com/files/162284/Nagios-XI-5.7.3-Remote-Code-Execution.html https://www.tenable.com/security/research/tra-2020-58