Vulnerability record · CVE-2013-1362 · published 9 July 2013
CVE-2013-1362: Nagios NRPE incomplete blacklist allows shell command execution
Opensuse · Opensuse
NRPE before 2.14 uses an incomplete blacklist in nrpc.c that fails to block the "$()" shell metacharacter sequence, which is then processed by bash. A remote attacker can therefore inject shell commands that execute with the privileges of the NRPE process. This matters because NRPE is commonly deployed to run checks on monitored hosts, so command execution there can compromise the monitored system.
Description
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated command execution with a public exploit and very high EPSS, though not listed in KEV and requiring the NRPE service to be exposed.
What it is
NRPE before 2.14 uses an incomplete blacklist in nrpc.c that fails to block the "$()" shell metacharacter sequence, which is then processed by bash. A remote attacker can therefore inject shell commands that execute with the privileges of the NRPE process. This matters because NRPE is commonly deployed to run checks on monitored hosts, so command execution there can compromise the monitored system.
Impact
An attacker gains arbitrary shell command execution on the host running the vulnerable NRPE daemon, with the privileges of that service. This can lead to full compromise of the monitored system depending on how NRPE is configured and run.
Attack surface
The flaw is reachable over the network via the NRPE service (AV:N, AC:L, Au:N), so no authentication or user interaction is required per the CVSS vector. The description does not state which NRPE commands or ports are involved beyond the nrpc.c handling of shell metacharacters.
Exploitation
CISA KEV does not list this CVE, but EPSS is high at roughly 0.657 (99.2nd percentile) and a public Exploit-DB entry (24955) exists, indicating exploit code is available. The record does not confirm active exploitation in the wild.
What to do
- Upgrade NRPE to version 2.14 or later, which fixes the incomplete blacklist.
- If immediate upgrade is not possible, restrict network access to the NRPE port to trusted monitoring servers only.
- Run the NRPE daemon with the least privileges necessary and avoid running it as root where feasible.
- Review NRPE command definitions and remove or tightly constrain any commands that pass untrusted input to a shell.
- Monitor vendor advisories from Nagios and openSUSE for backported fixes.
Detection
- Inspect NRPE logs and process execution for shell metacharacters such as "$()" in command arguments.
- Alert on unexpected child processes spawned by the NRPE daemon, especially shells or command interpreters.
- Monitor network connections to the NRPE service from hosts outside the expected monitoring infrastructure.
- Audit NRPE configuration files for commands that invoke bash or other shells with externally supplied parameters.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-1362 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-1362), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
