CVE-2012-6096: Nagios Core and Icinga history.cgi stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploits and very high EPSS, though not confirmed in KEV.

What it is

The get_history function in history.cgi in Nagios Core before 3.4.4 and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4 contains multiple stack-based buffer overflows. A long host_name (host parameter) or svc_description value can overwrite stack memory, and the flaw matters because history.cgi is a network-facing CGI that can be reached without authentication.

Impact

A remote attacker can execute arbitrary code with the privileges of the web server or CGI process, or at minimum crash the service. Successful exploitation gives code execution on the monitoring host, which often holds broad infrastructure access.

Attack surface

Reached over the network via HTTP requests to history.cgi with crafted host or service parameters, per the AV:N/AC:L/Au:N vector. No authentication or user interaction is required according to the CVSS vector and description.

Exploitation

Public exploit code exists in Exploit-DB (24084, 24159) and SecurityFocus, and EPSS is 0.6645 (99.2 percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is recorded here.

What to do

• Upgrade Nagios Core to 3.4.4 or later and Icinga to 1.6.2, 1.7.4, or 1.8.4 or later.
• Apply the vendor and distribution patches referenced by Debian DSA-2616/DSA-2653 and openSUSE updates if immediate upgrade is not possible.
• Restrict access to history.cgi and the Nagios/Icinga web interface to trusted management networks or authenticated reverse proxies.
• Run the web/CGI process with least privilege and isolate the monitoring server from general user networks.

Detection

• Inspect web and CGI logs for requests to history.cgi with unusually long host or service parameters.
• Alert on crashes or restarts of the Nagios/Icinga CGI or web server processes.
• Monitor for unexpected child processes or outbound connections originating from the monitoring web server.
• Use network or WAF signatures for oversized parameters targeting history.cgi.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.