CVE-2016-9566: nagios Link Following
Vulnerability summary
CVE-2016-9566 is a high (CVSS 7.8) Link Following vulnerability in nagios. EPSS estimates a 4.88% chance of exploitation in the next 30 days, higher than 91.9% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 13 · Related 4Timeline
- 15-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.88%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.88% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (legalhackers.com)
Maturity: unknown
Nagios < 4.2.4 - Local Privilege Escalation
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Affected systems
Nagios1 product
- nagios≤ 4.2.3
Ubuntu1 product
- nagios3< 3.5.1-1ubuntu1.1 | < 3.5.1.dfsg-2.1ubuntu1.1
2 vendors · 2 products
References
21 links- github.com/NagiosEnterprises/nagioscore/commit/c29557dec91eba2306f5fb11b8da4474ba63f8c4X Refsource CONFIRMIssue TrackingPatch
Show all 21 references
- legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.htmlX Refsource MISCExploitThird Party Advisory