CVE-2016-2056: Xymon xymond command injection via adduser_name argument

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote authenticated command execution with high EPSS and public exploit write-ups, though it requires a valid account and is not in KEV.

What it is

Xymon versions 4.1.x, 4.2.x and 4.3.x before 4.3.25 pass the adduser_name argument from web/useradm.c and web/chpasswd.c to xymond without sanitizing shell metacharacters. An authenticated remote user can inject commands that execute with the privileges of the xymond process. The flaw is a classic OS command injection (CWE-77) in a monitoring platform, so compromise of the Xymon server can expose the systems it monitors.

Impact

An attacker with a valid account gains arbitrary command execution on the Xymon server, leading to full compromise of confidentiality, integrity and availability of that host. From there the attacker can pivot to monitored infrastructure and stored monitoring data.

Attack surface

Reached over the network through the Xymon web interface endpoints useradm.c and chpasswd.c; the CVSS vector shows AV:N/AC:L/PR:L/UI:N, so a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is 0.54507 (98.9th percentile) and public Packetstorm exploit write-ups exist, indicating meaningful real-world exploitation likelihood.

What to do

• Upgrade Xymon to 4.3.25 or later, which contains the upstream fix (sourceforge.net/p/xymon/code/7892/); apply the Debian DSA-3495 package update if running Debian.
• If immediate patching is not possible, restrict access to the Xymon web administration interfaces (useradm.c, chpasswd.c) to trusted administrators only.
• Run xymond and the Xymon web components under a dedicated low-privilege account, not root, to limit command execution impact.
• Audit Xymon accounts and remove or disable unused ones, since exploitation requires an authenticated session.
• Monitor and alert on unexpected child processes or shell invocations spawned by xymond.

Detection

• Review Xymon web server and xymond logs for requests to useradm.c or chpasswd.c containing shell metacharacters such as ;, |, $(), backticks or && in the adduser_name parameter.
• Hunt for unexpected processes or command lines spawned as children of xymond or the Xymon web server.
• Alert on new or modified local accounts and on outbound connections originating from the Xymon host that are not part of normal monitoring traffic.
• Correlate Xymon admin-interface access with subsequent system changes on the Xymon server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.