CVE-2016-9565: nagios Improper Access Control
Vulnerability summary
CVE-2016-9565 is a critical (CVSS 9.8) Improper Access Control vulnerability in nagios. EPSS estimates a 22.68% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 8Timeline
- 15-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
22.68%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 22.68% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (legalhackers.com)
Maturity: unknown
Nagios < 4.2.2 - Arbitrary Code Execution
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Nagios1 product
- nagios≤ 4.2.1
Ubuntu1 product
- nagios3< 3.5.1-1ubuntu1
2 vendors · 2 products
References
18 links- packetstormsecurity.com/files/140169/Nagios-Core-Curl-Command-Injection-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
Show all 18 references
- legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.htmlX Refsource MISCExploitThird Party AdvisoryREPORT